<!DOCTYPE html><html lang="zh-CN"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=2"><meta name="theme-color" content="#222"><meta name="generator" content="Hexo 4.2.0"><link rel="apple-touch-icon" sizes="180x180" href="/images/apple-touch-icon-next.png"><link rel="icon" type="image/png" sizes="32x32" href="/images/favicon-32x32-next.png"><link rel="icon" type="image/png" sizes="16x16" href="/images/favicon-16x16-next.png"><link rel="mask-icon" href="/images/logo.svg" color="#222"><link rel="stylesheet" href="/css/main.css"><link rel="stylesheet" href="/lib/font-awesome/css/all.min.css"><link rel="stylesheet" href="//cdn.jsdelivr.net/gh/fancyapps/fancybox@3/dist/jquery.fancybox.min.css"><script id="hexo-configurations">var NexT=window.NexT||{},CONFIG={hostname:"www.leeyuxun.github.io",root:"/",scheme:"Gemini",version:"7.8.0",exturl:!1,sidebar:{position:"left",display:"post",padding:18,offset:12,onmobile:!1},copycode:{enable:!0,show_result:!0,style:"mac"},back2top:{enable:!0,sidebar:!0,scrollpercent:!0},bookmark:{enable:!1,color:"#222",save:"auto"},fancybox:!0,mediumzoom:!1,lazyload:!1,pangu:!1,comments:{style:"tabs",active:null,storage:!0,lazyload:!1,nav:null},algolia:{hits:{per_page:10},labels:{input_placeholder:"Search for Posts",hits_empty:"We didn't find any results for the search: ${query}",hits_stats:"${hits} results found in ${time} ms"}},localsearch:{enable:!0,trigger:"auto",top_n_per_article:1,unescape:!1,preload:!1},motion:{enable:!0,async:!1,transition:{post_block:"fadeIn",post_header:"slideDownIn",post_body:"slideDownIn",coll_header:"slideLeftIn",sidebar:"slideUpIn"}},path:"./public/search.xml"}</script><meta name="description" content="前言JavaScript攻击属于Web前端安全，不存在黑盒测试的概念，直接可以对JS进行白盒代码审计。DVWA中的JavaScript攻击的场景是基于token由前端JS生成而引起的一系列问题。"><meta property="og:type" content="article"><meta property="og:title" content="DVWA JavaScript Attacks"><meta property="og:url" content="https://www.leeyuxun.github.io/DVWA-JavaScript-Attacks.html"><meta property="og:site_name" content="Leeyuxun の blog"><meta property="og:description" content="前言JavaScript攻击属于Web前端安全，不存在黑盒测试的概念，直接可以对JS进行白盒代码审计。DVWA中的JavaScript攻击的场景是基于token由前端JS生成而引起的一系列问题。"><meta property="og:locale" content="zh_CN"><meta property="og:image" content="https://leeyuxun-1258157351.cos.ap-beijing.myqcloud.com/img/20201123231356.png"><meta property="og:image" content="https://leeyuxun-1258157351.cos.ap-beijing.myqcloud.com/img/20201123231438.png"><meta property="og:image" content="https://leeyuxun-1258157351.cos.ap-beijing.myqcloud.com/img/20201123231522.png"><meta property="og:image" content="https://leeyuxun-1258157351.cos.ap-beijing.myqcloud.com/img/20201123233617.png"><meta property="og:image" content="https://leeyuxun-1258157351.cos.ap-beijing.myqcloud.com/img/20201123233828.png"><meta property="og:image" content="https://leeyuxun-1258157351.cos.ap-beijing.myqcloud.com/img/20201124000108.png"><meta property="og:image" content="https://leeyuxun-1258157351.cos.ap-beijing.myqcloud.com/img/20201124000123.png"><meta property="og:image" content="https://leeyuxun-1258157351.cos.ap-beijing.myqcloud.com/img/20201124000141.png"><meta property="og:image" content="https://leeyuxun-1258157351.cos.ap-beijing.myqcloud.com/img/20201124000108.png"><meta property="og:image" content="https://leeyuxun-1258157351.cos.ap-beijing.myqcloud.com/img/20201124001912.png"><meta property="og:image" content="https://leeyuxun-1258157351.cos.ap-beijing.myqcloud.com/img/20201124000141.png"><meta property="og:image" content="https://leeyuxun-1258157351.cos.ap-beijing.myqcloud.com/img/20201124002120.png"><meta property="article:published_time" content="2019-11-23T13:19:47.000Z"><meta property="article:modified_time" content="2020-11-23T16:52:02.482Z"><meta property="article:author" content="李钰璕"><meta property="article:tag" content="JavaScript Attacks"><meta name="twitter:card" content="summary"><meta name="twitter:image" content="https://leeyuxun-1258157351.cos.ap-beijing.myqcloud.com/img/20201123231356.png"><link rel="canonical" href="https://www.leeyuxun.github.io/DVWA-JavaScript-Attacks.html"><script id="page-configurations">CONFIG.page={sidebar:"",isHome:!1,isPost:!0,lang:"zh-CN"}</script><title>DVWA JavaScript Attacks | Leeyuxun の blog</title><script>function sendPageView(){if(CONFIG.hostname===location.hostname){var e=localStorage.getItem("uid")||Math.random()+"."+Math.random();localStorage.setItem("uid",e),navigator.sendBeacon("https://www.google-analytics.com/collect",new URLSearchParams({v:1,tid:"UA-163555158-1",cid:e,t:"pageview",dp:encodeURIComponent(location.pathname)}))}}document.addEventListener("pjax:complete",sendPageView),sendPageView()</script><noscript><style>.sidebar-inner,.use-motion .brand,.use-motion .collection-header,.use-motion .comments,.use-motion .menu-item,.use-motion .pagination,.use-motion .post-block,.use-motion .post-body,.use-motion .post-header{opacity:initial}.use-motion .site-subtitle,.use-motion .site-title{opacity:initial;top:initial}.use-motion .logo-line-before i{left:initial}.use-motion .logo-line-after i{right:initial}</style></noscript></head><body itemscope itemtype="http://schema.org/WebPage"><div class="container use-motion"><div class="headband"></div><header class="header" itemscope itemtype="http://schema.org/WPHeader"><div class="header-inner"><div class="site-brand-container"><div class="site-nav-toggle"><div class="toggle" aria-label="切换导航栏"><span class="toggle-line toggle-line-first"></span> <span class="toggle-line toggle-line-middle"></span> <span class="toggle-line toggle-line-last"></span></div></div><div class="site-meta"><a href="/" class="brand" rel="start"><span class="logo-line-before"><i></i></span><h1 class="site-title">Leeyuxun の blog</h1><span class="logo-line-after"><i></i></span></a><p class="site-subtitle" itemprop="description">BUPT | SCSS</p></div><div class="site-nav-right"><div class="toggle popup-trigger"><i class="fa fa-search fa-fw fa-lg"></i></div></div></div><nav class="site-nav"><ul id="menu" class="menu"><li class="menu-item menu-item-home"><a href="/" rel="section"><i class="fa fa-home fa-fw"></i>首页</a></li><li class="menu-item menu-item-tags"><a href="/tags/" rel="section"><i class="fa fa-tags fa-fw"></i>标签</a></li><li class="menu-item menu-item-categories"><a href="/categories/" rel="section"><i class="fa fa-th fa-fw"></i>分类</a></li><li class="menu-item menu-item-archives"><a href="/archives/" rel="section"><i class="fa fa-archive fa-fw"></i>归档</a></li><li class="menu-item menu-item-links"><a href="/links/" rel="section"><i class="fa fa-link fa-fw"></i>友链</a></li><li class="menu-item menu-item-search"><a role="button" class="popup-trigger"><i class="fa fa-search fa-fw"></i>搜索</a></li></ul></nav><div class="search-pop-overlay"><div class="popup search-popup"><div class="search-header"><span class="search-icon"><i class="fa fa-search"></i></span><div class="search-input-container"><input autocomplete="off" autocapitalize="off" placeholder="搜索..." spellcheck="false" type="search" class="search-input"></div><span class="popup-btn-close"><i class="fa fa-times-circle"></i></span></div><div id="search-result"><div id="no-result"><i class="fa fa-spinner fa-pulse fa-5x fa-fw"></i></div></div></div></div></div></header><main class="main"><div class="main-inner"><div class="content-wrap"><div class="content post posts-expand"><article itemscope itemtype="http://schema.org/Article" class="post-block" lang="zh-CN"><link itemprop="mainEntityOfPage" href="https://www.leeyuxun.github.io/DVWA-JavaScript-Attacks.html"><span hidden itemprop="author" itemscope itemtype="http://schema.org/Person"><meta itemprop="image" content="/images/avatar.png"><meta itemprop="name" content="李钰璕"><meta itemprop="description" content="从0开始学习网络安全"></span><span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization"><meta itemprop="name" content="Leeyuxun の blog"></span><header class="post-header"><h1 class="post-title" itemprop="name headline">DVWA JavaScript Attacks</h1><div class="post-meta"><span class="post-meta-item"><span class="post-meta-item-icon"><i class="far fa-calendar"></i> </span><span class="post-meta-item-text">发表于</span> <time title="创建时间：2019-11-23 21:19:47" itemprop="dateCreated datePublished" datetime="2019-11-23T21:19:47+08:00">2019-11-23</time> </span><span class="post-meta-item"><span class="post-meta-item-icon"><i class="far fa-calendar-check"></i> </span><span class="post-meta-item-text">更新于</span> <time title="修改时间：2020-11-24 00:52:02" itemprop="dateModified" datetime="2020-11-24T00:52:02+08:00">2020-11-24</time> </span><span class="post-meta-item"><span class="post-meta-item-icon"><i class="far fa-folder"></i> </span><span class="post-meta-item-text">分类于</span> <span itemprop="about" itemscope itemtype="http://schema.org/Thing"><a href="/categories/DVWA/" itemprop="url" rel="index"><span itemprop="name">DVWA</span></a> </span></span><span class="post-meta-item" title="阅读次数" id="busuanzi_container_page_pv" style="display:none"><span class="post-meta-item-icon"><i class="fa fa-eye"></i> </span><span class="post-meta-item-text">阅读次数：</span> <span id="busuanzi_value_page_pv"></span></span></div></header><div class="post-body" itemprop="articleBody"><h1 id="前言"><a href="#前言" class="headerlink" title="前言"></a>前言</h1><p>JavaScript攻击属于Web前端安全，不存在黑盒测试的概念，直接可以对JS进行白盒代码审计。</p><p>DVWA中的JavaScript攻击的场景是基于token由前端JS生成而引起的一系列问题。<a id="more"></a></p><h1 id="LOW"><a href="#LOW" class="headerlink" title="LOW"></a>LOW</h1><h2 id="分析"><a href="#分析" class="headerlink" title="分析"></a>分析</h2><p>打开页面如下；</p><p><img src="https://leeyuxun-1258157351.cos.ap-beijing.myqcloud.com/img/20201123231356.png" alt=""></p><p>输入ChangeMe，显示错误；</p><p><img src="https://leeyuxun-1258157351.cos.ap-beijing.myqcloud.com/img/20201123231438.png" alt=""></p><p>输入success，显示不合法token值；</p><p><img src="https://leeyuxun-1258157351.cos.ap-beijing.myqcloud.com/img/20201123231522.png" alt=""></p><p>怀疑前端回直接修改token，查看前端源码，发现隐藏输入token；</p><figure class="highlight html"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line"><span class="tag">&lt;<span class="name">form</span> <span class="attr">name</span>=<span class="string">"low_js"</span> <span class="attr">method</span>=<span class="string">"post"</span>&gt;</span></span><br><span class="line">		<span class="tag">&lt;<span class="name">input</span> <span class="attr">type</span>=<span class="string">"hidden"</span> <span class="attr">name</span>=<span class="string">"token"</span> <span class="attr">value</span>=<span class="string">"8b479aefbd90795395b3e7089ae0dc09"</span> <span class="attr">id</span>=<span class="string">"token"</span>&gt;</span></span><br><span class="line">		<span class="tag">&lt;<span class="name">label</span> <span class="attr">for</span>=<span class="string">"phrase"</span>&gt;</span>Phrase<span class="tag">&lt;/<span class="name">label</span>&gt;</span> <span class="tag">&lt;<span class="name">input</span> <span class="attr">type</span>=<span class="string">"text"</span> <span class="attr">name</span>=<span class="string">"phrase"</span> <span class="attr">value</span>=<span class="string">"ChangeMe"</span> <span class="attr">id</span>=<span class="string">"phrase"</span>&gt;</span></span><br><span class="line">		<span class="tag">&lt;<span class="name">input</span> <span class="attr">type</span>=<span class="string">"submit"</span> <span class="attr">id</span>=<span class="string">"send"</span> <span class="attr">name</span>=<span class="string">"send"</span> <span class="attr">value</span>=<span class="string">"Submit"</span>&gt;</span></span><br><span class="line"><span class="tag">&lt;/<span class="name">form</span>&gt;</span></span><br></pre></td></tr></table></figure><p>根据隐藏token的值，猜测是MD5加密，查看源码；</p><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br></pre></td><td class="code"><pre><span class="line"> &lt;?php</span><br><span class="line">    $page[ &#39;body&#39; ] .&#x3D; &lt;&lt;&lt;EOF</span><br><span class="line">    &lt;script&gt;</span><br><span class="line">    &#x2F;*</span><br><span class="line">    MD5 code from here</span><br><span class="line">    https:&#x2F;&#x2F;github.com&#x2F;blueimp&#x2F;JavaScript-MD5</span><br><span class="line">    *&#x2F;</span><br><span class="line">    !function(n)&#123;&quot;use strict&quot;;function t(n,t)&#123;var r&#x3D;(65535&amp;n)+(65535&amp;t);return(n&gt;&gt;16)+(t&gt;&gt;16)+(r&gt;&gt;16)&lt;&lt;16|65535&amp;r&#125;function r(n,t)&#123;return n&lt;&lt;t|n&gt;&gt;&gt;32-t&#125;function e(n,e,o,u,c,f)&#123;return t(r(t(t(e,n),t(u,f)),c),o)&#125;function o(n,t,r,o,u,c,f)&#123;return e(t&amp;r|~t&amp;o,n,t,u,c,f)&#125;function u(n,t,r,o,u,c,f)&#123;return e(t&amp;o|r&amp;~o,n,t,u,c,f)&#125;function c(n,t,r,o,u,c,f)&#123;return e(t^r^o,n,t,u,c,f)&#125;function f(n,t,r,o,u,c,f)&#123;return e(r^(t|~o),n,t,u,c,f)&#125;function i(n,r)&#123;n[r&gt;&gt;5]|&#x3D;128&lt;&lt;r%32,n[14+(r+64&gt;&gt;&gt;9&lt;&lt;4)]&#x3D;r;var e,i,a,d,h,l&#x3D;1732584193,g&#x3D;-271733879,v&#x3D;-1732584194,m&#x3D;271733878;for(e&#x3D;0;e&lt;n.length;e+&#x3D;16)i&#x3D;l,a&#x3D;g,d&#x3D;v,h&#x3D;m,g&#x3D;f(g&#x3D;f(g&#x3D;f(g&#x3D;f(g&#x3D;c(g&#x3D;c(g&#x3D;c(g&#x3D;c(g&#x3D;u(g&#x3D;u(g&#x3D;u(g&#x3D;u(g&#x3D;o(g&#x3D;o(g&#x3D;o(g&#x3D;o(g,v&#x3D;o(v,m&#x3D;o(m,l&#x3D;o(l,g,v,m,n[e],7,-680876936),g,v,n[e+1],12,-389564586),l,g,n[e+2],17,606105819),m,l,n[e+3],22,-1044525330),v&#x3D;o(v,m&#x3D;o(m,l&#x3D;o(l,g,v,m,n[e+4],7,-176418897),g,v,n[e+5],12,1200080426),l,g,n[e+6],17,-1473231341),m,l,n[e+7],22,-45705983),v&#x3D;o(v,m&#x3D;o(m,l&#x3D;o(l,g,v,m,n[e+8],7,1770035416),g,v,n[e+9],12,-1958414417),l,g,n[e+10],17,-42063),m,l,n[e+11],22,-1990404162),v&#x3D;o(v,m&#x3D;o(m,l&#x3D;o(l,g,v,m,n[e+12],7,1804603682),g,v,n[e+13],12,-40341101),l,g,n[e+14],17,-1502002290),m,l,n[e+15],22,1236535329),v&#x3D;u(v,m&#x3D;u(m,l&#x3D;u(l,g,v,m,n[e+1],5,-165796510),g,v,n[e+6],9,-1069501632),l,g,n[e+11],14,643717713),m,l,n[e],20,-373897302),v&#x3D;u(v,m&#x3D;u(m,l&#x3D;u(l,g,v,m,n[e+5],5,-701558691),g,v,n[e+10],9,38016083),l,g,n[e+15],14,-660478335),m,l,n[e+4],20,-405537848),v&#x3D;u(v,m&#x3D;u(m,l&#x3D;u(l,g,v,m,n[e+9],5,568446438),g,v,n[e+14],9,-1019803690),l,g,n[e+3],14,-187363961),m,l,n[e+8],20,1163531501),v&#x3D;u(v,m&#x3D;u(m,l&#x3D;u(l,g,v,m,n[e+13],5,-1444681467),g,v,n[e+2],9,-51403784),l,g,n[e+7],14,1735328473),m,l,n[e+12],20,-1926607734),v&#x3D;c(v,m&#x3D;c(m,l&#x3D;c(l,g,v,m,n[e+5],4,-378558),g,v,n[e+8],11,-2022574463),l,g,n[e+11],16,1839030562),m,l,n[e+14],23,-35309556),v&#x3D;c(v,m&#x3D;c(m,l&#x3D;c(l,g,v,m,n[e+1],4,-1530992060),g,v,n[e+4],11,1272893353),l,g,n[e+7],16,-155497632),m,l,n[e+10],23,-1094730640),v&#x3D;c(v,m&#x3D;c(m,l&#x3D;c(l,g,v,m,n[e+13],4,681279174),g,v,n[e],11,-358537222),l,g,n[e+3],16,-722521979),m,l,n[e+6],23,76029189),v&#x3D;c(v,m&#x3D;c(m,l&#x3D;c(l,g,v,m,n[e+9],4,-640364487),g,v,n[e+12],11,-421815835),l,g,n[e+15],16,530742520),m,l,n[e+2],23,-995338651),v&#x3D;f(v,m&#x3D;f(m,l&#x3D;f(l,g,v,m,n[e],6,-198630844),g,v,n[e+7],10,1126891415),l,g,n[e+14],15,-1416354905),m,l,n[e+5],21,-57434055),v&#x3D;f(v,m&#x3D;f(m,l&#x3D;f(l,g,v,m,n[e+12],6,1700485571),g,v,n[e+3],10,-1894986606),l,g,n[e+10],15,-1051523),m,l,n[e+1],21,-2054922799),v&#x3D;f(v,m&#x3D;f(m,l&#x3D;f(l,g,v,m,n[e+8],6,1873313359),g,v,n[e+15],10,-30611744),l,g,n[e+6],15,-1560198380),m,l,n[e+13],21,1309151649),v&#x3D;f(v,m&#x3D;f(m,l&#x3D;f(l,g,v,m,n[e+4],6,-145523070),g,v,n[e+11],10,-1120210379),l,g,n[e+2],15,718787259),m,l,n[e+9],21,-343485551),l&#x3D;t(l,i),g&#x3D;t(g,a),v&#x3D;t(v,d),m&#x3D;t(m,h);return[l,g,v,m]&#125;function a(n)&#123;var t,r&#x3D;&quot;&quot;,e&#x3D;32*n.length;for(t&#x3D;0;t&lt;e;t+&#x3D;8)r+&#x3D;String.fromCharCode(n[t&gt;&gt;5]&gt;&gt;&gt;t%32&amp;255);return r&#125;function d(n)&#123;var t,r&#x3D;[];for(r[(n.length&gt;&gt;2)-1]&#x3D;void 0,t&#x3D;0;t&lt;r.length;t+&#x3D;1)r[t]&#x3D;0;var e&#x3D;8*n.length;for(t&#x3D;0;t&lt;e;t+&#x3D;8)r[t&gt;&gt;5]|&#x3D;(255&amp;n.charCodeAt(t&#x2F;8))&lt;&lt;t%32;return r&#125;function h(n)&#123;return a(i(d(n),8*n.length))&#125;function l(n,t)&#123;var r,e,o&#x3D;d(n),u&#x3D;[],c&#x3D;[];for(u[15]&#x3D;c[15]&#x3D;void 0,o.length&gt;16&amp;&amp;(o&#x3D;i(o,8*n.length)),r&#x3D;0;r&lt;16;r+&#x3D;1)u[r]&#x3D;909522486^o[r],c[r]&#x3D;1549556828^o[r];return e&#x3D;i(u.concat(d(t)),512+8*t.length),a(i(c.concat(e),640))&#125;function g(n)&#123;var t,r,e&#x3D;&quot;&quot;;for(r&#x3D;0;r&lt;n.length;r+&#x3D;1)t&#x3D;n.charCodeAt(r),e+&#x3D;&quot;0123456789abcdef&quot;.charAt(t&gt;&gt;&gt;4&amp;15)+&quot;0123456789abcdef&quot;.charAt(15&amp;t);return e&#125;function v(n)&#123;return unescape(encodeURIComponent(n))&#125;function m(n)&#123;return h(v(n))&#125;function p(n)&#123;return g(m(n))&#125;function s(n,t)&#123;return l(v(n),v(t))&#125;function C(n,t)&#123;return g(s(n,t))&#125;function A(n,t,r)&#123;return t?r?s(t,n):C(t,n):r?m(n):p(n)&#125;&quot;function&quot;&#x3D;&#x3D;typeof define&amp;&amp;define.amd?define(function()&#123;return A&#125;):&quot;object&quot;&#x3D;&#x3D;typeof module&amp;&amp;module.exports?module.exports&#x3D;A:n.md5&#x3D;A&#125;(this);</span><br><span class="line">        function rot13(inp) &#123;</span><br><span class="line">            return inp.replace(&#x2F;[a-zA-Z]&#x2F;g,function(c)&#123;return String.fromCharCode((c&lt;&#x3D;&quot;Z&quot;?90:122)&gt;&#x3D;(c&#x3D;c.charCodeAt(0)+13)?c:c-26);&#125;);</span><br><span class="line">        &#125;</span><br><span class="line">        function generate_token() &#123;</span><br><span class="line">            var phrase &#x3D; document.getElementById(&quot;phrase&quot;).value;</span><br><span class="line">            document.getElementById(&quot;token&quot;).value &#x3D; md5(rot13(phrase));</span><br><span class="line">        &#125;</span><br><span class="line">        generate_token();</span><br><span class="line">    &lt;&#x2F;script&gt;</span><br><span class="line">    EOF;</span><br><span class="line">?&gt;</span><br></pre></td></tr></table></figure><p>实现了对输入的phrase进行一次rot13后再进行一次MD5加密；</p><p>提示要求输入success，此处猜测要提取MD5(rot13(“sucess”))作为token值，在浏览器控制栏计算该MD5值；</p><p><img src="https://leeyuxun-1258157351.cos.ap-beijing.myqcloud.com/img/20201123233617.png" alt=""></p><p>前端更改隐藏输入的值，再次输入success后显示成功；</p><p><img src="https://leeyuxun-1258157351.cos.ap-beijing.myqcloud.com/img/20201123233828.png" alt=""></p><h1 id="MEDIUM"><a href="#MEDIUM" class="headerlink" title="MEDIUM"></a>MEDIUM</h1><h2 id="分析-1"><a href="#分析-1" class="headerlink" title="分析"></a>分析</h2><p>查看前端源码，发现和LOW级别类似，只是将JavaScript代码放在了文件中引用；</p><figure class="highlight html"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line"><span class="tag">&lt;<span class="name">form</span> <span class="attr">name</span>=<span class="string">"low_js"</span> <span class="attr">method</span>=<span class="string">"post"</span>&gt;</span></span><br><span class="line">		<span class="tag">&lt;<span class="name">input</span> <span class="attr">type</span>=<span class="string">"hidden"</span> <span class="attr">name</span>=<span class="string">"token"</span> <span class="attr">value</span>=<span class="string">"XXeMegnahCXX"</span> <span class="attr">id</span>=<span class="string">"token"</span>&gt;</span></span><br><span class="line">		<span class="tag">&lt;<span class="name">label</span> <span class="attr">for</span>=<span class="string">"phrase"</span>&gt;</span>Phrase<span class="tag">&lt;/<span class="name">label</span>&gt;</span> <span class="tag">&lt;<span class="name">input</span> <span class="attr">type</span>=<span class="string">"text"</span> <span class="attr">name</span>=<span class="string">"phrase"</span> <span class="attr">value</span>=<span class="string">"ChangeMe"</span> <span class="attr">id</span>=<span class="string">"phrase"</span>&gt;</span></span><br><span class="line">		<span class="tag">&lt;<span class="name">input</span> <span class="attr">type</span>=<span class="string">"submit"</span> <span class="attr">id</span>=<span class="string">"send"</span> <span class="attr">name</span>=<span class="string">"send"</span> <span class="attr">value</span>=<span class="string">"Submit"</span>&gt;</span></span><br><span class="line"><span class="tag">&lt;/<span class="name">form</span>&gt;</span></span><br><span class="line"><span class="tag">&lt;<span class="name">script</span> <span class="attr">src</span>=<span class="string">"../../vulnerabilities/javascript/source/medium.js"</span>&gt;</span><span class="tag">&lt;/<span class="name">script</span>&gt;</span></span><br></pre></td></tr></table></figure><p>JavaScript代码如下；</p><figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">do_something</span>(<span class="params">e</span>)</span>&#123;</span><br><span class="line">  <span class="keyword">for</span>(<span class="keyword">var</span> t=<span class="string">""</span>,n=e.length<span class="number">-1</span>;n&gt;=<span class="number">0</span>;n--)</span><br><span class="line">    t+=e[n];</span><br><span class="line">  <span class="keyword">return</span> t;</span><br><span class="line">&#125;</span><br><span class="line">setTimeout(<span class="function"><span class="keyword">function</span>(<span class="params"></span>)</span>&#123;do_elsesomething(<span class="string">"XX"</span>)&#125;,<span class="number">300</span>);</span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">do_elsesomething</span>(<span class="params">e</span>)</span>&#123;</span><br><span class="line">  <span class="built_in">document</span>.getElementById(<span class="string">"token"</span>).value=do_something(e+<span class="built_in">document</span>.getElementById(<span class="string">"phrase"</span>).value+<span class="string">"XX"</span>);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure><p>分析代码，其功能是将phrase变量的值逆序；</p><p>只需要在输入框输入 “success” 后，在控制台中，输入<code>do_elsesomething(&quot;XX&quot;)</code>，再点击提交即可；</p><p><img src="https://leeyuxun-1258157351.cos.ap-beijing.myqcloud.com/img/20201124000108.png" alt=""></p><p><img src="https://leeyuxun-1258157351.cos.ap-beijing.myqcloud.com/img/20201124000123.png" alt=""></p><p><img src="https://leeyuxun-1258157351.cos.ap-beijing.myqcloud.com/img/20201124000141.png" alt=""></p><h1 id="HIGH"><a href="#HIGH" class="headerlink" title="HIGH"></a>HIGH</h1><h2 id="分析-2"><a href="#分析-2" class="headerlink" title="分析"></a>分析</h2><p>HIGH级别和MEDIUM级别类似，生成token的逻辑在JavaScript文件中；</p><figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">var</span> a=[<span class="string">'fromCharCode'</span>,<span class="string">'toString'</span>,<span class="string">'replace'</span>,<span class="string">'BeJ'</span>,<span class="string">'\x5cw+'</span>,<span class="string">'Lyg'</span>,<span class="string">'SuR'</span>,<span class="string">'(w()&#123;\x273M\x203L\x27;q\x201l=\x273K\x203I\x203J\x20T\x27;q\x201R=1c\x202I===\x271n\x27;q\x20Y=1R?2I:&#123;&#125;;p(Y.3N)&#123;1R=1O&#125;q\x202L=!1R&amp;&amp;1c\x202M===\x271n\x27;q\x202o=!Y.2S&amp;&amp;1c\x202d===\x271n\x27&amp;&amp;2d.2Q&amp;&amp;2d.2Q.3S;p(2o)&#123;Y=3R&#125;z\x20p(2L)&#123;Y=2M&#125;q\x202G=!Y.3Q&amp;&amp;1c\x202g===\x271n\x27&amp;&amp;2g.X;q\x202s=1c\x202l===\x27w\x27&amp;&amp;2l.3P;q\x201y=!Y.3H&amp;&amp;1c\x20Z!==\x272T\x27;q\x20m=\x273G\x27.3z(\x27\x27);q\x202w=[-3y,3x,3v,3w];q\x20U=[24,16,8,0];q\x20K=[3A,3B,3F,3E,3D,3C,3T,3U,4d,4c,4b,49,4a,4e,4f,4j,4i,4h,3u,48,47,3Z,3Y,3X,3V,3W,40,41,46,45,43,42,4k,3f,38,36,39,37,34,33,2Y,31,2Z,35,3t,3n,3m,3l,3o,3p,3s,3r,3q,3k,3j,3d,3a,3c,3b,3e,3h,3g,3i,4g];q\x201E=[\x271e\x27,\x2727\x27,\x271G\x27,\x272R\x27];q\x20l=[];p(Y.2S||!1z.1K)&#123;1z.1K=w(1x)&#123;A\x204C.Q.2U.1I(1x)===\x27[1n\x201z]\x27&#125;&#125;p(1y&amp;&amp;(Y.50||!Z.1N))&#123;Z.1N=w(1x)&#123;A\x201c\x201x===\x271n\x27&amp;&amp;1x.1w&amp;&amp;1x.1w.1J===Z&#125;&#125;q\x202m=w(1X,x)&#123;A\x20w(s)&#123;A\x20O\x20N(x,1d).S(s)[1X]()&#125;&#125;;q\x202a=w(x)&#123;q\x20P=2m(\x271e\x27,x);p(2o)&#123;P=2P(P,x)&#125;P.1T=w()&#123;A\x20O\x20N(x)&#125;;P.S=w(s)&#123;A\x20P.1T().S(s)&#125;;1g(q\x20i=0;i&lt;1E.W;++i)&#123;q\x20T=1E[i];P[T]=2m(T,x)&#125;A\x20P&#125;;q\x202P=w(P,x)&#123;q\x201S=2O(\x222N(\x271S\x27)\x22);q\x201Y=2O(\x222N(\x271w\x27).1Y\x22);q\x202n=x?\x271H\x27:\x271q\x27;q\x202z=w(s)&#123;p(1c\x20s===\x272p\x27)&#123;A\x201S.2x(2n).S(s,\x274S\x27).1G(\x271e\x27)&#125;z&#123;p(s===2q||s===2T)&#123;1u\x20O\x201t(1l)&#125;z\x20p(s.1J===Z)&#123;s=O\x202r(s)&#125;&#125;p(1z.1K(s)||Z.1N(s)||s.1J===1Y)&#123;A\x201S.2x(2n).S(O\x201Y(s)).1G(\x271e\x27)&#125;z&#123;A\x20P(s)&#125;&#125;;A\x202z&#125;;q\x202k=w(1X,x)&#123;A\x20w(G,s)&#123;A\x20O\x201P(G,x,1d).S(s)[1X]()&#125;&#125;;q\x202f=w(x)&#123;q\x20P=2k(\x271e\x27,x);P.1T=w(G)&#123;A\x20O\x201P(G,x)&#125;;P.S=w(G,s)&#123;A\x20P.1T(G).S(s)&#125;;1g(q\x20i=0;i&lt;1E.W;++i)&#123;q\x20T=1E[i];P[T]=2k(T,x)&#125;A\x20P&#125;;w\x20N(x,1v)&#123;p(1v)&#123;l[0]=l[16]=l[1]=l[2]=l[3]=l[4]=l[5]=l[6]=l[7]=l[8]=l[9]=l[10]=l[11]=l[12]=l[13]=l[14]=l[15]=0;k.l=l&#125;z&#123;k.l=[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]&#125;p(x)&#123;k.C=4I;k.B=4H;k.E=4l;k.F=4U;k.J=4J;k.I=4K;k.H=4L;k.D=4T&#125;z&#123;k.C=4X;k.B=4W;k.E=4Y;k.F=4Z;k.J=4V;k.I=4O;k.H=4F;k.D=4s&#125;k.1C=k.1A=k.L=k.2i=0;k.1U=k.1L=1O;k.2j=1d;k.x=x&#125;N.Q.S=w(s)&#123;p(k.1U)&#123;A&#125;q\x202h,T=1c\x20s;p(T!==\x272p\x27)&#123;p(T===\x271n\x27)&#123;p(s===2q)&#123;1u\x20O\x201t(1l)&#125;z\x20p(1y&amp;&amp;s.1J===Z)&#123;s=O\x202r(s)&#125;z\x20p(!1z.1K(s))&#123;p(!1y||!Z.1N(s))&#123;1u\x20O\x201t(1l)&#125;&#125;&#125;z&#123;1u\x20O\x201t(1l)&#125;2h=1d&#125;q\x20r,M=0,i,W=s.W,l=k.l;4t(M&lt;W)&#123;p(k.1L)&#123;k.1L=1O;l[0]=k.1C;l[16]=l[1]=l[2]=l[3]=l[4]=l[5]=l[6]=l[7]=l[8]=l[9]=l[10]=l[11]=l[12]=l[13]=l[14]=l[15]=0&#125;p(2h)&#123;1g(i=k.1A;M&lt;W&amp;&amp;i&lt;1k;++M)&#123;l[i&gt;&gt;2]|=s[M]&lt;&lt;U[i++&amp;3]&#125;&#125;z&#123;1g(i=k.1A;M&lt;W&amp;&amp;i&lt;1k;++M)&#123;r=s.1Q(M);p(r&lt;R)&#123;l[i&gt;&gt;2]|=r&lt;&lt;U[i++&amp;3]&#125;z\x20p(r&lt;2v)&#123;l[i&gt;&gt;2]|=(2t|(r&gt;&gt;6))&lt;&lt;U[i++&amp;3];l[i&gt;&gt;2]|=(R|(r&amp;V))&lt;&lt;U[i++&amp;3]&#125;z\x20p(r&lt;2A||r&gt;=2E)&#123;l[i&gt;&gt;2]|=(2D|(r&gt;&gt;12))&lt;&lt;U[i++&amp;3];l[i&gt;&gt;2]|=(R|((r&gt;&gt;6)&amp;V))&lt;&lt;U[i++&amp;3];l[i&gt;&gt;2]|=(R|(r&amp;V))&lt;&lt;U[i++&amp;3]&#125;z&#123;r=2C+(((r&amp;23)&lt;&lt;10)|(s.1Q(++M)&amp;23));l[i&gt;&gt;2]|=(2X|(r&gt;&gt;18))&lt;&lt;U[i++&amp;3];l[i&gt;&gt;2]|=(R|((r&gt;&gt;12)&amp;V))&lt;&lt;U[i++&amp;3];l[i&gt;&gt;2]|=(R|((r&gt;&gt;6)&amp;V))&lt;&lt;U[i++&amp;3];l[i&gt;&gt;2]|=(R|(r&amp;V))&lt;&lt;U[i++&amp;3]&#125;&#125;&#125;k.2u=i;k.L+=i-k.1A;p(i&gt;=1k)&#123;k.1C=l[16];k.1A=i-1k;k.1W();k.1L=1d&#125;z&#123;k.1A=i&#125;&#125;p(k.L&gt;4r)&#123;k.2i+=k.L/2H&lt;&lt;0;k.L=k.L%2H&#125;A\x20k&#125;;N.Q.1s=w()&#123;p(k.1U)&#123;A&#125;k.1U=1d;q\x20l=k.l,i=k.2u;l[16]=k.1C;l[i&gt;&gt;2]|=2w[i&amp;3];k.1C=l[16];p(i&gt;=4q)&#123;p(!k.1L)&#123;k.1W()&#125;l[0]=k.1C;l[16]=l[1]=l[2]=l[3]=l[4]=l[5]=l[6]=l[7]=l[8]=l[9]=l[10]=l[11]=l[12]=l[13]=l[14]=l[15]=0&#125;l[14]=k.2i&lt;&lt;3|k.L&gt;&gt;&gt;29;l[15]=k.L&lt;&lt;3;k.1W()&#125;;N.Q.1W=w()&#123;q\x20a=k.C,b=k.B,c=k.E,d=k.F,e=k.J,f=k.I,g=k.H,h=k.D,l=k.l,j,1a,1b,1j,v,1f,1h,1B,1Z,1V,1D;1g(j=16;j&lt;1k;++j)&#123;v=l[j-15];1a=((v&gt;&gt;&gt;7)|(v&lt;&lt;25))^((v&gt;&gt;&gt;18)|(v&lt;&lt;14))^(v&gt;&gt;&gt;3);v=l[j-2];1b=((v&gt;&gt;&gt;17)|(v&lt;&lt;15))^((v&gt;&gt;&gt;19)|(v&lt;&lt;13))^(v&gt;&gt;&gt;10);l[j]=l[j-16]+1a+l[j-7]+1b&lt;&lt;0&#125;1D=b&amp;c;1g(j=0;j&lt;1k;j+=4)&#123;p(k.2j)&#123;p(k.x)&#123;1B=4m;v=l[0]-4n;h=v-4o&lt;&lt;0;d=v+4p&lt;&lt;0&#125;z&#123;1B=4v;v=l[0]-4w;h=v-4G&lt;&lt;0;d=v+4D&lt;&lt;0&#125;k.2j=1O&#125;z&#123;1a=((a&gt;&gt;&gt;2)|(a&lt;&lt;30))^((a&gt;&gt;&gt;13)|(a&lt;&lt;19))^((a&gt;&gt;&gt;22)|(a&lt;&lt;10));1b=((e&gt;&gt;&gt;6)|(e&lt;&lt;26))^((e&gt;&gt;&gt;11)|(e&lt;&lt;21))^((e&gt;&gt;&gt;25)|(e&lt;&lt;7));1B=a&amp;b;1j=1B^(a&amp;c)^1D;1h=(e&amp;f)^(~e&amp;g);v=h+1b+1h+K[j]+l[j];1f=1a+1j;h=d+v&lt;&lt;0;d=v+1f&lt;&lt;0&#125;1a=((d&gt;&gt;&gt;2)|(d&lt;&lt;30))^((d&gt;&gt;&gt;13)|(d&lt;&lt;19))^((d&gt;&gt;&gt;22)|(d&lt;&lt;10));1b=((h&gt;&gt;&gt;6)|(h&lt;&lt;26))^((h&gt;&gt;&gt;11)|(h&lt;&lt;21))^((h&gt;&gt;&gt;25)|(h&lt;&lt;7));1Z=d&amp;a;1j=1Z^(d&amp;b)^1B;1h=(h&amp;e)^(~h&amp;f);v=g+1b+1h+K[j+1]+l[j+1];1f=1a+1j;g=c+v&lt;&lt;0;c=v+1f&lt;&lt;0;1a=((c&gt;&gt;&gt;2)|(c&lt;&lt;30))^((c&gt;&gt;&gt;13)|(c&lt;&lt;19))^((c&gt;&gt;&gt;22)|(c&lt;&lt;10));1b=((g&gt;&gt;&gt;6)|(g&lt;&lt;26))^((g&gt;&gt;&gt;11)|(g&lt;&lt;21))^((g&gt;&gt;&gt;25)|(g&lt;&lt;7));1V=c&amp;d;1j=1V^(c&amp;a)^1Z;1h=(g&amp;h)^(~g&amp;e);v=f+1b+1h+K[j+2]+l[j+2];1f=1a+1j;f=b+v&lt;&lt;0;b=v+1f&lt;&lt;0;1a=((b&gt;&gt;&gt;2)|(b&lt;&lt;30))^((b&gt;&gt;&gt;13)|(b&lt;&lt;19))^((b&gt;&gt;&gt;22)|(b&lt;&lt;10));1b=((f&gt;&gt;&gt;6)|(f&lt;&lt;26))^((f&gt;&gt;&gt;11)|(f&lt;&lt;21))^((f&gt;&gt;&gt;25)|(f&lt;&lt;7));1D=b&amp;c;1j=1D^(b&amp;d)^1V;1h=(f&amp;g)^(~f&amp;h);v=e+1b+1h+K[j+3]+l[j+3];1f=1a+1j;e=a+v&lt;&lt;0;a=v+1f&lt;&lt;0&#125;k.C=k.C+a&lt;&lt;0;k.B=k.B+b&lt;&lt;0;k.E=k.E+c&lt;&lt;0;k.F=k.F+d&lt;&lt;0;k.J=k.J+e&lt;&lt;0;k.I=k.I+f&lt;&lt;0;k.H=k.H+g&lt;&lt;0;k.D=k.D+h&lt;&lt;0&#125;;N.Q.1e=w()&#123;k.1s();q\x20C=k.C,B=k.B,E=k.E,F=k.F,J=k.J,I=k.I,H=k.H,D=k.D;q\x201e=m[(C&gt;&gt;28)&amp;o]+m[(C&gt;&gt;24)&amp;o]+m[(C&gt;&gt;20)&amp;o]+m[(C&gt;&gt;16)&amp;o]+m[(C&gt;&gt;12)&amp;o]+m[(C&gt;&gt;8)&amp;o]+m[(C&gt;&gt;4)&amp;o]+m[C&amp;o]+m[(B&gt;&gt;28)&amp;o]+m[(B&gt;&gt;24)&amp;o]+m[(B&gt;&gt;20)&amp;o]+m[(B&gt;&gt;16)&amp;o]+m[(B&gt;&gt;12)&amp;o]+m[(B&gt;&gt;8)&amp;o]+m[(B&gt;&gt;4)&amp;o]+m[B&amp;o]+m[(E&gt;&gt;28)&amp;o]+m[(E&gt;&gt;24)&amp;o]+m[(E&gt;&gt;20)&amp;o]+m[(E&gt;&gt;16)&amp;o]+m[(E&gt;&gt;12)&amp;o]+m[(E&gt;&gt;8)&amp;o]+m[(E&gt;&gt;4)&amp;o]+m[E&amp;o]+m[(F&gt;&gt;28)&amp;o]+m[(F&gt;&gt;24)&amp;o]+m[(F&gt;&gt;20)&amp;o]+m[(F&gt;&gt;16)&amp;o]+m[(F&gt;&gt;12)&amp;o]+m[(F&gt;&gt;8)&amp;o]+m[(F&gt;&gt;4)&amp;o]+m[F&amp;o]+m[(J&gt;&gt;28)&amp;o]+m[(J&gt;&gt;24)&amp;o]+m[(J&gt;&gt;20)&amp;o]+m[(J&gt;&gt;16)&amp;o]+m[(J&gt;&gt;12)&amp;o]+m[(J&gt;&gt;8)&amp;o]+m[(J&gt;&gt;4)&amp;o]+m[J&amp;o]+m[(I&gt;&gt;28)&amp;o]+m[(I&gt;&gt;24)&amp;o]+m[(I&gt;&gt;20)&amp;o]+m[(I&gt;&gt;16)&amp;o]+m[(I&gt;&gt;12)&amp;o]+m[(I&gt;&gt;8)&amp;o]+m[(I&gt;&gt;4)&amp;o]+m[I&amp;o]+m[(H&gt;&gt;28)&amp;o]+m[(H&gt;&gt;24)&amp;o]+m[(H&gt;&gt;20)&amp;o]+m[(H&gt;&gt;16)&amp;o]+m[(H&gt;&gt;12)&amp;o]+m[(H&gt;&gt;8)&amp;o]+m[(H&gt;&gt;4)&amp;o]+m[H&amp;o];p(!k.x)&#123;1e+=m[(D&gt;&gt;28)&amp;o]+m[(D&gt;&gt;24)&amp;o]+m[(D&gt;&gt;20)&amp;o]+m[(D&gt;&gt;16)&amp;o]+m[(D&gt;&gt;12)&amp;o]+m[(D&gt;&gt;8)&amp;o]+m[(D&gt;&gt;4)&amp;o]+m[D&amp;o]&#125;A\x201e&#125;;N.Q.2U=N.Q.1e;N.Q.1G=w()&#123;k.1s();q\x20C=k.C,B=k.B,E=k.E,F=k.F,J=k.J,I=k.I,H=k.H,D=k.D;q\x202b=[(C&gt;&gt;24)&amp;u,(C&gt;&gt;16)&amp;u,(C&gt;&gt;8)&amp;u,C&amp;u,(B&gt;&gt;24)&amp;u,(B&gt;&gt;16)&amp;u,(B&gt;&gt;8)&amp;u,B&amp;u,(E&gt;&gt;24)&amp;u,(E&gt;&gt;16)&amp;u,(E&gt;&gt;8)&amp;u,E&amp;u,(F&gt;&gt;24)&amp;u,(F&gt;&gt;16)&amp;u,(F&gt;&gt;8)&amp;u,F&amp;u,(J&gt;&gt;24)&amp;u,(J&gt;&gt;16)&amp;u,(J&gt;&gt;8)&amp;u,J&amp;u,(I&gt;&gt;24)&amp;u,(I&gt;&gt;16)&amp;u,(I&gt;&gt;8)&amp;u,I&amp;u,(H&gt;&gt;24)&amp;u,(H&gt;&gt;16)&amp;u,(H&gt;&gt;8)&amp;u,H&amp;u];p(!k.x)&#123;2b.4A((D&gt;&gt;24)&amp;u,(D&gt;&gt;16)&amp;u,(D&gt;&gt;8)&amp;u,D&amp;u)&#125;A\x202b&#125;;N.Q.27=N.Q.1G;N.Q.2R=w()&#123;k.1s();q\x201w=O\x20Z(k.x?28:32);q\x201i=O\x204x(1w);1i.1p(0,k.C);1i.1p(4,k.B);1i.1p(8,k.E);1i.1p(12,k.F);1i.1p(16,k.J);1i.1p(20,k.I);1i.1p(24,k.H);p(!k.x)&#123;1i.1p(28,k.D)&#125;A\x201w&#125;;w\x201P(G,x,1v)&#123;q\x20i,T=1c\x20G;p(T===\x272p\x27)&#123;q\x20L=[],W=G.W,M=0,r;1g(i=0;i&lt;W;++i)&#123;r=G.1Q(i);p(r&lt;R)&#123;L[M++]=r&#125;z\x20p(r&lt;2v)&#123;L[M++]=(2t|(r&gt;&gt;6));L[M++]=(R|(r&amp;V))&#125;z\x20p(r&lt;2A||r&gt;=2E)&#123;L[M++]=(2D|(r&gt;&gt;12));L[M++]=(R|((r&gt;&gt;6)&amp;V));L[M++]=(R|(r&amp;V))&#125;z&#123;r=2C+(((r&amp;23)&lt;&lt;10)|(G.1Q(++i)&amp;23));L[M++]=(2X|(r&gt;&gt;18));L[M++]=(R|((r&gt;&gt;12)&amp;V));L[M++]=(R|((r&gt;&gt;6)&amp;V));L[M++]=(R|(r&amp;V))&#125;&#125;G=L&#125;z&#123;p(T===\x271n\x27)&#123;p(G===2q)&#123;1u\x20O\x201t(1l)&#125;z\x20p(1y&amp;&amp;G.1J===Z)&#123;G=O\x202r(G)&#125;z\x20p(!1z.1K(G))&#123;p(!1y||!Z.1N(G))&#123;1u\x20O\x201t(1l)&#125;&#125;&#125;z&#123;1u\x20O\x201t(1l)&#125;&#125;p(G.W&gt;1k)&#123;G=(O\x20N(x,1d)).S(G).27()&#125;q\x201F=[],2e=[];1g(i=0;i&lt;1k;++i)&#123;q\x20b=G[i]||0;1F[i]=4z^b;2e[i]=4y^b&#125;N.1I(k,x,1v);k.S(2e);k.1F=1F;k.2c=1d;k.1v=1v&#125;1P.Q=O\x20N();1P.Q.1s=w()&#123;N.Q.1s.1I(k);p(k.2c)&#123;k.2c=1O;q\x202W=k.27();N.1I(k,k.x,k.1v);k.S(k.1F);k.S(2W);N.Q.1s.1I(k)&#125;&#125;;q\x20X=2a();X.1q=X;X.1H=2a(1d);X.1q.2V=2f();X.1H.2V=2f(1d);p(2G)&#123;2g.X=X&#125;z&#123;Y.1q=X.1q;Y.1H=X.1H;p(2s)&#123;2l(w()&#123;A\x20X&#125;)&#125;&#125;&#125;)();w\x202y(e)&#123;1g(q\x20t=\x22\x22,n=e.W-1;n&gt;=0;n--)t+=e[n];A\x20t&#125;w\x202J(t,y=\x224B\x22)&#123;1m.1o(\x221M\x22).1r=1q(1m.1o(\x221M\x22).1r+y)&#125;w\x202B(e=\x224E\x22)&#123;1m.1o(\x221M\x22).1r=1q(e+1m.1o(\x221M\x22).1r)&#125;w\x202K(a,b)&#123;1m.1o(\x221M\x22).1r=2y(1m.1o(\x222F\x22).1r)&#125;1m.1o(\x222F\x22).1r=\x22\x22;4u(w()&#123;2B(\x224M\x22)&#125;,4N);1m.1o(\x224P\x22).4Q(\x224R\x22,2J);2K(\x223O\x22,44);'</span>,<span class="string">'||||||||||||||||||||this|blocks|HEX_CHARS||0x0F|if|var|code|message||0xFF|t1|function|is224||else|return|h1|h0|h7|h2|h3|key|h6|h5|h4||bytes|index|Sha256|new|method|prototype|0x80|update|type|SHIFT|0x3f|length|exports|root|ArrayBuffer|||||||||||s0|s1|typeof|true|hex|t2|for|ch|dataView|maj|64|ERROR|document|object|getElementById|setUint32|sha256|value|finalize|Error|throw|sharedMemory|buffer|obj|ARRAY_BUFFER|Array|start|ab|block|bc|OUTPUT_TYPES|oKeyPad|digest|sha224|call|constructor|isArray|hashed|token|isView|false|HmacSha256|charCodeAt|WINDOW|crypto|create|finalized|cd|hash|outputType|Buffer|da||||0x3ff||||array|||createMethod|arr|inner|process|iKeyPad|createHmacMethod|module|notString|hBytes|first|createHmacOutputMethod|define|createOutputMethod|algorithm|NODE_JS|string|null|Uint8Array|AMD|0xc0|lastByteIndex|0x800|EXTRA|createHash|do_something|nodeMethod|0xd800|token_part_2|0x10000|0xe0|0xe000|phrase|COMMON_JS|4294967296|window|token_part_3|token_part_1|WEB_WORKER|self|require|eval|nodeWrap|versions|arrayBuffer|JS_SHA256_NO_NODE_JS|undefined|toString|hmac|innerHash|0xf0|0xa2bfe8a1|0xc24b8b70||0xa81a664b||0x92722c85|0x81c2c92e|0xc76c51a3|0x53380d13|0x766a0abb|0x4d2c6dfc|0x650a7354|0x748f82ee|0x84c87814|0x78a5636f|0x682e6ff3|0x8cc70208|0x2e1b2138|0xa4506ceb|0x90befffa|0xbef9a3f7|0x5b9cca4f|0x4ed8aa4a|0x106aa070|0xf40e3585|0xd6990624|0x19a4c116|0x1e376c08|0x391c0cb3|0x34b0bcb5|0x2748774c|0xd192e819|0x0fc19dc6|32768|128|8388608|2147483648|split|0x428a2f98|0x71374491|0x59f111f1|0x3956c25b|0xe9b5dba5|0xb5c0fbcf|0123456789abcdef|JS_SHA256_NO_ARRAY_BUFFER|is|invalid|input|strict|use|JS_SHA256_NO_WINDOW|ABCD|amd|JS_SHA256_NO_COMMON_JS|global|node|0x923f82a4|0xab1c5ed5|0x983e5152|0xa831c66d|0x76f988da|0x5cb0a9dc|0x4a7484aa|0xb00327c8|0xbf597fc7|0x14292967|0x06ca6351||0xd5a79147|0xc6e00bf3|0x2de92c6f|0x240ca1cc|0x550c7dc3|0x72be5d74|0x243185be|0x12835b01|0xd807aa98|0x80deb1fe|0x9bdc06a7|0xc67178f2|0xefbe4786|0xe49b69c1|0xc19bf174|0x27b70a85|0x3070dd17|300032|1413257819|150054599|24177077|56|4294967295|0x5be0cd19|while|setTimeout|704751109|210244248|DataView|0x36|0x5c|push|ZZ|Object|143694565|YY|0x1f83d9ab|1521486534|0x367cd507|0xc1059ed8|0xffc00b31|0x68581511|0x64f98fa7|XX|300|0x9b05688c|send|addEventListener|click|utf8|0xbefa4fa4|0xf70e5939|0x510e527f|0xbb67ae85|0x6a09e667|0x3c6ef372|0xa54ff53a|JS_SHA256_NO_ARRAY_BUFFER_IS_VIEW'</span>,<span class="string">'split'</span>];(<span class="function"><span class="keyword">function</span>(<span class="params">c,d</span>)</span>&#123;<span class="keyword">var</span> e=<span class="function"><span class="keyword">function</span>(<span class="params">f</span>)</span>&#123;<span class="keyword">while</span>(--f)&#123;c[<span class="string">'push'</span>](c[<span class="string">'shift'</span>]());&#125;&#125;;e(++d);&#125;(a,<span class="number">0x1f4</span>));<span class="keyword">var</span> b=<span class="function"><span class="keyword">function</span>(<span class="params">c,d</span>)</span>&#123;c=c<span class="number">-0x0</span>;<span class="keyword">var</span> e=a[c];<span class="keyword">return</span> e;&#125;;<span class="built_in">eval</span>(<span class="function"><span class="keyword">function</span>(<span class="params">d,e,f,g,h,i</span>)</span>&#123;h=<span class="function"><span class="keyword">function</span>(<span class="params">j</span>)</span>&#123;<span class="keyword">return</span>(j&lt;e?<span class="string">''</span>:h(<span class="built_in">parseInt</span>(j/e)))+((j=j%e)&gt;<span class="number">0x23</span>?<span class="built_in">String</span>[b(<span class="string">'0x0'</span>)](j+<span class="number">0x1d</span>):j[b(<span class="string">'0x1'</span>)](<span class="number">0x24</span>));&#125;;<span class="keyword">if</span>(!<span class="string">''</span>[b(<span class="string">'0x2'</span>)](<span class="regexp">/^/</span>,<span class="built_in">String</span>))&#123;<span class="keyword">while</span>(f--)&#123;i[h(f)]=g[f]||h(f);&#125;g=[<span class="function"><span class="keyword">function</span>(<span class="params">k</span>)</span>&#123;<span class="keyword">if</span>(<span class="string">'wpA'</span>!==b(<span class="string">'0x3'</span>))&#123;<span class="keyword">return</span> i[k];&#125;<span class="keyword">else</span>&#123;<span class="keyword">while</span>(f--)&#123;i[k(f)]=g[f]||k(f);&#125;g=[<span class="function"><span class="keyword">function</span>(<span class="params">l</span>)</span>&#123;<span class="keyword">return</span> i[l];&#125;];k=<span class="function"><span class="keyword">function</span>(<span class="params"></span>)</span>&#123;<span class="keyword">return</span> b(<span class="string">'0x4'</span>);&#125;;f=<span class="number">0x1</span>;&#125;&#125;];h=<span class="function"><span class="keyword">function</span>(<span class="params"></span>)</span>&#123;<span class="keyword">return</span> b(<span class="string">'0x4'</span>);&#125;;f=<span class="number">0x1</span>;&#125;;<span class="keyword">while</span>(f--)&#123;<span class="keyword">if</span>(g[f])&#123;<span class="keyword">if</span>(b(<span class="string">'0x5'</span>)===b(<span class="string">'0x6'</span>))&#123;<span class="keyword">return</span> i[h];&#125;<span class="keyword">else</span>&#123;d=d[b(<span class="string">'0x2'</span>)](<span class="keyword">new</span> <span class="built_in">RegExp</span>(<span class="string">'\x5cb'</span>+h(f)+<span class="string">'\x5cb'</span>,<span class="string">'g'</span>),g[f]);&#125;&#125;&#125;<span class="keyword">return</span> d;&#125;(b(<span class="string">'0x7'</span>),<span class="number">0x3e</span>,<span class="number">0x137</span>,b(<span class="string">'0x8'</span>)[b(<span class="string">'0x9'</span>)](<span class="string">'|'</span>),<span class="number">0x0</span>,&#123;&#125;));</span><br></pre></td></tr></table></figure><p>分析JavaScript代码，已经做了混淆；</p><p>使用在线解码工具<a href="http://deobfuscatejavascript.com/#解码如下；" target="_blank" rel="noopener">http://deobfuscatejavascript.com/#解码如下；</a></p><figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br><span class="line">71</span><br><span class="line">72</span><br><span class="line">73</span><br><span class="line">74</span><br><span class="line">75</span><br><span class="line">76</span><br><span class="line">77</span><br><span class="line">78</span><br><span class="line">79</span><br><span class="line">80</span><br><span class="line">81</span><br><span class="line">82</span><br><span class="line">83</span><br><span class="line">84</span><br><span class="line">85</span><br><span class="line">86</span><br><span class="line">87</span><br><span class="line">88</span><br><span class="line">89</span><br><span class="line">90</span><br><span class="line">91</span><br><span class="line">92</span><br><span class="line">93</span><br><span class="line">94</span><br><span class="line">95</span><br><span class="line">96</span><br><span class="line">97</span><br><span class="line">98</span><br><span class="line">99</span><br><span class="line">100</span><br><span class="line">101</span><br><span class="line">102</span><br><span class="line">103</span><br><span class="line">104</span><br><span class="line">105</span><br><span class="line">106</span><br><span class="line">107</span><br><span class="line">108</span><br><span class="line">109</span><br><span class="line">110</span><br><span class="line">111</span><br><span class="line">112</span><br><span class="line">113</span><br><span class="line">114</span><br><span class="line">115</span><br><span class="line">116</span><br><span class="line">117</span><br><span class="line">118</span><br><span class="line">119</span><br><span class="line">120</span><br><span class="line">121</span><br><span class="line">122</span><br><span class="line">123</span><br><span class="line">124</span><br><span class="line">125</span><br><span class="line">126</span><br><span class="line">127</span><br><span class="line">128</span><br><span class="line">129</span><br><span class="line">130</span><br><span class="line">131</span><br><span class="line">132</span><br><span class="line">133</span><br><span class="line">134</span><br><span class="line">135</span><br><span class="line">136</span><br><span class="line">137</span><br><span class="line">138</span><br><span class="line">139</span><br><span class="line">140</span><br><span class="line">141</span><br><span class="line">142</span><br><span class="line">143</span><br><span class="line">144</span><br><span class="line">145</span><br><span class="line">146</span><br><span class="line">147</span><br><span class="line">148</span><br><span class="line">149</span><br><span class="line">150</span><br><span class="line">151</span><br><span class="line">152</span><br><span class="line">153</span><br><span class="line">154</span><br><span class="line">155</span><br><span class="line">156</span><br><span class="line">157</span><br><span class="line">158</span><br><span class="line">159</span><br><span class="line">160</span><br><span class="line">161</span><br><span class="line">162</span><br><span class="line">163</span><br><span class="line">164</span><br><span class="line">165</span><br><span class="line">166</span><br><span class="line">167</span><br><span class="line">168</span><br><span class="line">169</span><br><span class="line">170</span><br><span class="line">171</span><br><span class="line">172</span><br><span class="line">173</span><br><span class="line">174</span><br><span class="line">175</span><br><span class="line">176</span><br><span class="line">177</span><br><span class="line">178</span><br><span class="line">179</span><br><span class="line">180</span><br><span class="line">181</span><br><span class="line">182</span><br><span class="line">183</span><br><span class="line">184</span><br><span class="line">185</span><br><span class="line">186</span><br><span class="line">187</span><br><span class="line">188</span><br><span class="line">189</span><br><span class="line">190</span><br><span class="line">191</span><br><span class="line">192</span><br><span class="line">193</span><br><span class="line">194</span><br><span class="line">195</span><br><span class="line">196</span><br><span class="line">197</span><br><span class="line">198</span><br><span class="line">199</span><br><span class="line">200</span><br><span class="line">201</span><br><span class="line">202</span><br><span class="line">203</span><br><span class="line">204</span><br><span class="line">205</span><br><span class="line">206</span><br><span class="line">207</span><br><span class="line">208</span><br><span class="line">209</span><br><span class="line">210</span><br><span class="line">211</span><br><span class="line">212</span><br><span class="line">213</span><br><span class="line">214</span><br><span class="line">215</span><br><span class="line">216</span><br><span class="line">217</span><br><span class="line">218</span><br><span class="line">219</span><br><span class="line">220</span><br><span class="line">221</span><br><span class="line">222</span><br><span class="line">223</span><br><span class="line">224</span><br><span class="line">225</span><br><span class="line">226</span><br><span class="line">227</span><br><span class="line">228</span><br><span class="line">229</span><br><span class="line">230</span><br><span class="line">231</span><br><span class="line">232</span><br><span class="line">233</span><br><span class="line">234</span><br><span class="line">235</span><br><span class="line">236</span><br><span class="line">237</span><br><span class="line">238</span><br><span class="line">239</span><br><span class="line">240</span><br><span class="line">241</span><br><span class="line">242</span><br><span class="line">243</span><br><span class="line">244</span><br><span class="line">245</span><br><span class="line">246</span><br><span class="line">247</span><br><span class="line">248</span><br><span class="line">249</span><br><span class="line">250</span><br><span class="line">251</span><br><span class="line">252</span><br><span class="line">253</span><br><span class="line">254</span><br><span class="line">255</span><br><span class="line">256</span><br><span class="line">257</span><br><span class="line">258</span><br><span class="line">259</span><br><span class="line">260</span><br><span class="line">261</span><br><span class="line">262</span><br><span class="line">263</span><br><span class="line">264</span><br><span class="line">265</span><br><span class="line">266</span><br><span class="line">267</span><br><span class="line">268</span><br><span class="line">269</span><br><span class="line">270</span><br><span class="line">271</span><br><span class="line">272</span><br><span class="line">273</span><br><span class="line">274</span><br><span class="line">275</span><br><span class="line">276</span><br><span class="line">277</span><br><span class="line">278</span><br><span class="line">279</span><br><span class="line">280</span><br><span class="line">281</span><br><span class="line">282</span><br><span class="line">283</span><br><span class="line">284</span><br><span class="line">285</span><br><span class="line">286</span><br><span class="line">287</span><br><span class="line">288</span><br><span class="line">289</span><br><span class="line">290</span><br><span class="line">291</span><br><span class="line">292</span><br><span class="line">293</span><br><span class="line">294</span><br><span class="line">295</span><br><span class="line">296</span><br><span class="line">297</span><br><span class="line">298</span><br><span class="line">299</span><br><span class="line">300</span><br><span class="line">301</span><br><span class="line">302</span><br><span class="line">303</span><br><span class="line">304</span><br><span class="line">305</span><br><span class="line">306</span><br><span class="line">307</span><br><span class="line">308</span><br><span class="line">309</span><br><span class="line">310</span><br><span class="line">311</span><br><span class="line">312</span><br><span class="line">313</span><br><span class="line">314</span><br><span class="line">315</span><br><span class="line">316</span><br><span class="line">317</span><br><span class="line">318</span><br><span class="line">319</span><br><span class="line">320</span><br><span class="line">321</span><br><span class="line">322</span><br><span class="line">323</span><br><span class="line">324</span><br><span class="line">325</span><br><span class="line">326</span><br><span class="line">327</span><br><span class="line">328</span><br><span class="line">329</span><br><span class="line">330</span><br><span class="line">331</span><br><span class="line">332</span><br><span class="line">333</span><br><span class="line">334</span><br><span class="line">335</span><br><span class="line">336</span><br><span class="line">337</span><br><span class="line">338</span><br><span class="line">339</span><br><span class="line">340</span><br><span class="line">341</span><br><span class="line">342</span><br><span class="line">343</span><br><span class="line">344</span><br><span class="line">345</span><br><span class="line">346</span><br><span class="line">347</span><br><span class="line">348</span><br><span class="line">349</span><br><span class="line">350</span><br><span class="line">351</span><br><span class="line">352</span><br><span class="line">353</span><br><span class="line">354</span><br><span class="line">355</span><br><span class="line">356</span><br><span class="line">357</span><br><span class="line">358</span><br><span class="line">359</span><br><span class="line">360</span><br><span class="line">361</span><br><span class="line">362</span><br><span class="line">363</span><br><span class="line">364</span><br><span class="line">365</span><br><span class="line">366</span><br><span class="line">367</span><br><span class="line">368</span><br><span class="line">369</span><br><span class="line">370</span><br><span class="line">371</span><br><span class="line">372</span><br><span class="line">373</span><br><span class="line">374</span><br><span class="line">375</span><br><span class="line">376</span><br><span class="line">377</span><br><span class="line">378</span><br><span class="line">379</span><br><span class="line">380</span><br><span class="line">381</span><br><span class="line">382</span><br><span class="line">383</span><br><span class="line">384</span><br><span class="line">385</span><br><span class="line">386</span><br><span class="line">387</span><br><span class="line">388</span><br><span class="line">389</span><br><span class="line">390</span><br><span class="line">391</span><br><span class="line">392</span><br><span class="line">393</span><br><span class="line">394</span><br><span class="line">395</span><br><span class="line">396</span><br><span class="line">397</span><br><span class="line">398</span><br><span class="line">399</span><br><span class="line">400</span><br><span class="line">401</span><br><span class="line">402</span><br><span class="line">403</span><br><span class="line">404</span><br><span class="line">405</span><br><span class="line">406</span><br><span class="line">407</span><br><span class="line">408</span><br><span class="line">409</span><br><span class="line">410</span><br><span class="line">411</span><br><span class="line">412</span><br><span class="line">413</span><br><span class="line">414</span><br><span class="line">415</span><br><span class="line">416</span><br><span class="line">417</span><br><span class="line">418</span><br><span class="line">419</span><br><span class="line">420</span><br><span class="line">421</span><br><span class="line">422</span><br><span class="line">423</span><br><span class="line">424</span><br><span class="line">425</span><br><span class="line">426</span><br><span class="line">427</span><br><span class="line">428</span><br><span class="line">429</span><br><span class="line">430</span><br><span class="line">431</span><br><span class="line">432</span><br><span class="line">433</span><br><span class="line">434</span><br><span class="line">435</span><br><span class="line">436</span><br><span class="line">437</span><br><span class="line">438</span><br><span class="line">439</span><br><span class="line">440</span><br><span class="line">441</span><br><span class="line">442</span><br><span class="line">443</span><br><span class="line">444</span><br><span class="line">445</span><br><span class="line">446</span><br><span class="line">447</span><br><span class="line">448</span><br><span class="line">449</span><br><span class="line">450</span><br><span class="line">451</span><br><span class="line">452</span><br><span class="line">453</span><br><span class="line">454</span><br><span class="line">455</span><br><span class="line">456</span><br><span class="line">457</span><br><span class="line">458</span><br><span class="line">459</span><br><span class="line">460</span><br><span class="line">461</span><br></pre></td><td class="code"><pre><span class="line">(<span class="function"><span class="keyword">function</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line"><span class="meta">    'use strict'</span>;</span><br><span class="line">    <span class="keyword">var</span> ERROR = <span class="string">'input is invalid type'</span>;</span><br><span class="line">    <span class="keyword">var</span> WINDOW = <span class="keyword">typeof</span> <span class="built_in">window</span> === <span class="string">'object'</span>;</span><br><span class="line">    <span class="keyword">var</span> root = WINDOW ? <span class="built_in">window</span> : &#123;&#125;;</span><br><span class="line">    <span class="keyword">if</span> (root.JS_SHA256_NO_WINDOW) &#123;</span><br><span class="line">        WINDOW = <span class="literal">false</span></span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">var</span> WEB_WORKER = !WINDOW &amp;&amp; <span class="keyword">typeof</span> self === <span class="string">'object'</span>;</span><br><span class="line">    <span class="keyword">var</span> NODE_JS = !root.JS_SHA256_NO_NODE_JS &amp;&amp; <span class="keyword">typeof</span> process === <span class="string">'object'</span> &amp;&amp; process.versions &amp;&amp; process.versions.node;</span><br><span class="line">    <span class="keyword">if</span> (NODE_JS) &#123;</span><br><span class="line">        root = global</span><br><span class="line">    &#125; <span class="keyword">else</span> <span class="keyword">if</span> (WEB_WORKER) &#123;</span><br><span class="line">        root = self</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">var</span> COMMON_JS = !root.JS_SHA256_NO_COMMON_JS &amp;&amp; <span class="keyword">typeof</span> <span class="built_in">module</span> === <span class="string">'object'</span> &amp;&amp; <span class="built_in">module</span>.exports;</span><br><span class="line">    <span class="keyword">var</span> AMD = <span class="keyword">typeof</span> define === <span class="string">'function'</span> &amp;&amp; define.amd;</span><br><span class="line">    <span class="keyword">var</span> ARRAY_BUFFER = !root.JS_SHA256_NO_ARRAY_BUFFER &amp;&amp; <span class="keyword">typeof</span> <span class="built_in">ArrayBuffer</span> !== <span class="string">'undefined'</span>;</span><br><span class="line">    <span class="keyword">var</span> HEX_CHARS = <span class="string">'0123456789abcdef'</span>.split(<span class="string">''</span>);</span><br><span class="line">    <span class="keyword">var</span> EXTRA = [<span class="number">-2147483648</span>, <span class="number">8388608</span>, <span class="number">32768</span>, <span class="number">128</span>];</span><br><span class="line">    <span class="keyword">var</span> SHIFT = [<span class="number">24</span>, <span class="number">16</span>, <span class="number">8</span>, <span class="number">0</span>];</span><br><span class="line">    <span class="keyword">var</span> K = [<span class="number">0x428a2f98</span>, <span class="number">0x71374491</span>, <span class="number">0xb5c0fbcf</span>, <span class="number">0xe9b5dba5</span>, <span class="number">0x3956c25b</span>, <span class="number">0x59f111f1</span>, <span class="number">0x923f82a4</span>, <span class="number">0xab1c5ed5</span>, <span class="number">0xd807aa98</span>, <span class="number">0x12835b01</span>, <span class="number">0x243185be</span>, <span class="number">0x550c7dc3</span>, <span class="number">0x72be5d74</span>, <span class="number">0x80deb1fe</span>, <span class="number">0x9bdc06a7</span>, <span class="number">0xc19bf174</span>, <span class="number">0xe49b69c1</span>, <span class="number">0xefbe4786</span>, <span class="number">0x0fc19dc6</span>, <span class="number">0x240ca1cc</span>, <span class="number">0x2de92c6f</span>, <span class="number">0x4a7484aa</span>, <span class="number">0x5cb0a9dc</span>, <span class="number">0x76f988da</span>, <span class="number">0x983e5152</span>, <span class="number">0xa831c66d</span>, <span class="number">0xb00327c8</span>, <span class="number">0xbf597fc7</span>, <span class="number">0xc6e00bf3</span>, <span class="number">0xd5a79147</span>, <span class="number">0x06ca6351</span>, <span class="number">0x14292967</span>, <span class="number">0x27b70a85</span>, <span class="number">0x2e1b2138</span>, <span class="number">0x4d2c6dfc</span>, <span class="number">0x53380d13</span>, <span class="number">0x650a7354</span>, <span class="number">0x766a0abb</span>, <span class="number">0x81c2c92e</span>, <span class="number">0x92722c85</span>, <span class="number">0xa2bfe8a1</span>, <span class="number">0xa81a664b</span>, <span class="number">0xc24b8b70</span>, <span class="number">0xc76c51a3</span>, <span class="number">0xd192e819</span>, <span class="number">0xd6990624</span>, <span class="number">0xf40e3585</span>, <span class="number">0x106aa070</span>, <span class="number">0x19a4c116</span>, <span class="number">0x1e376c08</span>, <span class="number">0x2748774c</span>, <span class="number">0x34b0bcb5</span>, <span class="number">0x391c0cb3</span>, <span class="number">0x4ed8aa4a</span>, <span class="number">0x5b9cca4f</span>, <span class="number">0x682e6ff3</span>, <span class="number">0x748f82ee</span>, <span class="number">0x78a5636f</span>, <span class="number">0x84c87814</span>, <span class="number">0x8cc70208</span>, <span class="number">0x90befffa</span>, <span class="number">0xa4506ceb</span>, <span class="number">0xbef9a3f7</span>, <span class="number">0xc67178f2</span>];</span><br><span class="line">    <span class="keyword">var</span> OUTPUT_TYPES = [<span class="string">'hex'</span>, <span class="string">'array'</span>, <span class="string">'digest'</span>, <span class="string">'arrayBuffer'</span>];</span><br><span class="line">    <span class="keyword">var</span> blocks = [];</span><br><span class="line">    <span class="keyword">if</span> (root.JS_SHA256_NO_NODE_JS || !<span class="built_in">Array</span>.isArray) &#123;</span><br><span class="line">        <span class="built_in">Array</span>.isArray = <span class="function"><span class="keyword">function</span>(<span class="params">obj</span>) </span>&#123;</span><br><span class="line">            <span class="keyword">return</span> <span class="built_in">Object</span>.prototype.toString.call(obj) === <span class="string">'[object Array]'</span></span><br><span class="line">        &#125;</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">if</span> (ARRAY_BUFFER &amp;&amp; (root.JS_SHA256_NO_ARRAY_BUFFER_IS_VIEW || !<span class="built_in">ArrayBuffer</span>.isView)) &#123;</span><br><span class="line">        <span class="built_in">ArrayBuffer</span>.isView = <span class="function"><span class="keyword">function</span>(<span class="params">obj</span>) </span>&#123;</span><br><span class="line">            <span class="keyword">return</span> <span class="keyword">typeof</span> obj === <span class="string">'object'</span> &amp;&amp; obj.buffer &amp;&amp; obj.buffer.constructor === <span class="built_in">ArrayBuffer</span></span><br><span class="line">        &#125;</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">var</span> createOutputMethod = <span class="function"><span class="keyword">function</span>(<span class="params">outputType, is224</span>) </span>&#123;</span><br><span class="line">            <span class="keyword">return</span> <span class="function"><span class="keyword">function</span>(<span class="params">message</span>) </span>&#123;</span><br><span class="line">                <span class="keyword">return</span> <span class="keyword">new</span> Sha256(is224, <span class="literal">true</span>).update(message)[outputType]()</span><br><span class="line">            &#125;</span><br><span class="line">        &#125;;</span><br><span class="line">    <span class="keyword">var</span> createMethod = <span class="function"><span class="keyword">function</span>(<span class="params">is224</span>) </span>&#123;</span><br><span class="line">            <span class="keyword">var</span> method = createOutputMethod(<span class="string">'hex'</span>, is224);</span><br><span class="line">            <span class="keyword">if</span> (NODE_JS) &#123;</span><br><span class="line">                method = nodeWrap(method, is224)</span><br><span class="line">            &#125;</span><br><span class="line">            method.create = <span class="function"><span class="keyword">function</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line">                <span class="keyword">return</span> <span class="keyword">new</span> Sha256(is224)</span><br><span class="line">            &#125;;</span><br><span class="line">            method.update = <span class="function"><span class="keyword">function</span>(<span class="params">message</span>) </span>&#123;</span><br><span class="line">                <span class="keyword">return</span> method.create().update(message)</span><br><span class="line">            &#125;;</span><br><span class="line">            <span class="keyword">for</span> (<span class="keyword">var</span> i = <span class="number">0</span>; i &lt; OUTPUT_TYPES.length; ++i) &#123;</span><br><span class="line">                <span class="keyword">var</span> type = OUTPUT_TYPES[i];</span><br><span class="line">                method[type] = createOutputMethod(type, is224)</span><br><span class="line">            &#125;</span><br><span class="line">            <span class="keyword">return</span> method</span><br><span class="line">        &#125;;</span><br><span class="line">    <span class="keyword">var</span> nodeWrap = <span class="function"><span class="keyword">function</span>(<span class="params">method, is224</span>) </span>&#123;</span><br><span class="line">            <span class="keyword">var</span> crypto = <span class="built_in">eval</span>(<span class="string">"require('crypto')"</span>);</span><br><span class="line">            <span class="keyword">var</span> Buffer = <span class="built_in">eval</span>(<span class="string">"require('buffer').Buffer"</span>);</span><br><span class="line">            <span class="keyword">var</span> algorithm = is224 ? <span class="string">'sha224'</span> : <span class="string">'sha256'</span>;</span><br><span class="line">            <span class="keyword">var</span> nodeMethod = <span class="function"><span class="keyword">function</span>(<span class="params">message</span>) </span>&#123;</span><br><span class="line">                    <span class="keyword">if</span> (<span class="keyword">typeof</span> message === <span class="string">'string'</span>) &#123;</span><br><span class="line">                        <span class="keyword">return</span> crypto.createHash(algorithm).update(message, <span class="string">'utf8'</span>).digest(<span class="string">'hex'</span>)</span><br><span class="line">                    &#125; <span class="keyword">else</span> &#123;</span><br><span class="line">                        <span class="keyword">if</span> (message === <span class="literal">null</span> || message === <span class="literal">undefined</span>) &#123;</span><br><span class="line">                            <span class="keyword">throw</span> <span class="keyword">new</span> <span class="built_in">Error</span>(ERROR)</span><br><span class="line">                        &#125; <span class="keyword">else</span> <span class="keyword">if</span> (message.constructor === <span class="built_in">ArrayBuffer</span>) &#123;</span><br><span class="line">                            message = <span class="keyword">new</span> <span class="built_in">Uint8Array</span>(message)</span><br><span class="line">                        &#125;</span><br><span class="line">                    &#125;</span><br><span class="line">                    <span class="keyword">if</span> (<span class="built_in">Array</span>.isArray(message) || <span class="built_in">ArrayBuffer</span>.isView(message) || message.constructor === Buffer) &#123;</span><br><span class="line">                        <span class="keyword">return</span> crypto.createHash(algorithm).update(<span class="keyword">new</span> Buffer(message)).digest(<span class="string">'hex'</span>)</span><br><span class="line">                    &#125; <span class="keyword">else</span> &#123;</span><br><span class="line">                        <span class="keyword">return</span> method(message)</span><br><span class="line">                    &#125;</span><br><span class="line">                &#125;;</span><br><span class="line">            <span class="keyword">return</span> nodeMethod</span><br><span class="line">        &#125;;</span><br><span class="line">    <span class="keyword">var</span> createHmacOutputMethod = <span class="function"><span class="keyword">function</span>(<span class="params">outputType, is224</span>) </span>&#123;</span><br><span class="line">            <span class="keyword">return</span> <span class="function"><span class="keyword">function</span>(<span class="params">key, message</span>) </span>&#123;</span><br><span class="line">                <span class="keyword">return</span> <span class="keyword">new</span> HmacSha256(key, is224, <span class="literal">true</span>).update(message)[outputType]()</span><br><span class="line">            &#125;</span><br><span class="line">        &#125;;</span><br><span class="line">    <span class="keyword">var</span> createHmacMethod = <span class="function"><span class="keyword">function</span>(<span class="params">is224</span>) </span>&#123;</span><br><span class="line">            <span class="keyword">var</span> method = createHmacOutputMethod(<span class="string">'hex'</span>, is224);</span><br><span class="line">            method.create = <span class="function"><span class="keyword">function</span>(<span class="params">key</span>) </span>&#123;</span><br><span class="line">                <span class="keyword">return</span> <span class="keyword">new</span> HmacSha256(key, is224)</span><br><span class="line">            &#125;;</span><br><span class="line">            method.update = <span class="function"><span class="keyword">function</span>(<span class="params">key, message</span>) </span>&#123;</span><br><span class="line">                <span class="keyword">return</span> method.create(key).update(message)</span><br><span class="line">            &#125;;</span><br><span class="line">            <span class="keyword">for</span> (<span class="keyword">var</span> i = <span class="number">0</span>; i &lt; OUTPUT_TYPES.length; ++i) &#123;</span><br><span class="line">                <span class="keyword">var</span> type = OUTPUT_TYPES[i];</span><br><span class="line">                method[type] = createHmacOutputMethod(type, is224)</span><br><span class="line">            &#125;</span><br><span class="line">            <span class="keyword">return</span> method</span><br><span class="line">        &#125;;</span><br><span class="line"></span><br><span class="line">    <span class="function"><span class="keyword">function</span> <span class="title">Sha256</span>(<span class="params">is224, sharedMemory</span>) </span>&#123;</span><br><span class="line">        <span class="keyword">if</span> (sharedMemory) &#123;</span><br><span class="line">            blocks[<span class="number">0</span>] = blocks[<span class="number">16</span>] = blocks[<span class="number">1</span>] = blocks[<span class="number">2</span>] = blocks[<span class="number">3</span>] = blocks[<span class="number">4</span>] = blocks[<span class="number">5</span>] = blocks[<span class="number">6</span>] = blocks[<span class="number">7</span>] = blocks[<span class="number">8</span>] = blocks[<span class="number">9</span>] = blocks[<span class="number">10</span>] = blocks[<span class="number">11</span>] = blocks[<span class="number">12</span>] = blocks[<span class="number">13</span>] = blocks[<span class="number">14</span>] = blocks[<span class="number">15</span>] = <span class="number">0</span>;</span><br><span class="line">            <span class="keyword">this</span>.blocks = blocks</span><br><span class="line">        &#125; <span class="keyword">else</span> &#123;</span><br><span class="line">            <span class="keyword">this</span>.blocks = [<span class="number">0</span>, <span class="number">0</span>, <span class="number">0</span>, <span class="number">0</span>, <span class="number">0</span>, <span class="number">0</span>, <span class="number">0</span>, <span class="number">0</span>, <span class="number">0</span>, <span class="number">0</span>, <span class="number">0</span>, <span class="number">0</span>, <span class="number">0</span>, <span class="number">0</span>, <span class="number">0</span>, <span class="number">0</span>, <span class="number">0</span>]</span><br><span class="line">        &#125;</span><br><span class="line">        <span class="keyword">if</span> (is224) &#123;</span><br><span class="line">            <span class="keyword">this</span>.h0 = <span class="number">0xc1059ed8</span>;</span><br><span class="line">            <span class="keyword">this</span>.h1 = <span class="number">0x367cd507</span>;</span><br><span class="line">            <span class="keyword">this</span>.h2 = <span class="number">0x3070dd17</span>;</span><br><span class="line">            <span class="keyword">this</span>.h3 = <span class="number">0xf70e5939</span>;</span><br><span class="line">            <span class="keyword">this</span>.h4 = <span class="number">0xffc00b31</span>;</span><br><span class="line">            <span class="keyword">this</span>.h5 = <span class="number">0x68581511</span>;</span><br><span class="line">            <span class="keyword">this</span>.h6 = <span class="number">0x64f98fa7</span>;</span><br><span class="line">            <span class="keyword">this</span>.h7 = <span class="number">0xbefa4fa4</span></span><br><span class="line">        &#125; <span class="keyword">else</span> &#123;</span><br><span class="line">            <span class="keyword">this</span>.h0 = <span class="number">0x6a09e667</span>;</span><br><span class="line">            <span class="keyword">this</span>.h1 = <span class="number">0xbb67ae85</span>;</span><br><span class="line">            <span class="keyword">this</span>.h2 = <span class="number">0x3c6ef372</span>;</span><br><span class="line">            <span class="keyword">this</span>.h3 = <span class="number">0xa54ff53a</span>;</span><br><span class="line">            <span class="keyword">this</span>.h4 = <span class="number">0x510e527f</span>;</span><br><span class="line">            <span class="keyword">this</span>.h5 = <span class="number">0x9b05688c</span>;</span><br><span class="line">            <span class="keyword">this</span>.h6 = <span class="number">0x1f83d9ab</span>;</span><br><span class="line">            <span class="keyword">this</span>.h7 = <span class="number">0x5be0cd19</span></span><br><span class="line">        &#125;</span><br><span class="line">        <span class="keyword">this</span>.block = <span class="keyword">this</span>.start = <span class="keyword">this</span>.bytes = <span class="keyword">this</span>.hBytes = <span class="number">0</span>;</span><br><span class="line">        <span class="keyword">this</span>.finalized = <span class="keyword">this</span>.hashed = <span class="literal">false</span>;</span><br><span class="line">        <span class="keyword">this</span>.first = <span class="literal">true</span>;</span><br><span class="line">        <span class="keyword">this</span>.is224 = is224</span><br><span class="line">    &#125;</span><br><span class="line">    Sha256.prototype.update = <span class="function"><span class="keyword">function</span>(<span class="params">message</span>) </span>&#123;</span><br><span class="line">        <span class="keyword">if</span> (<span class="keyword">this</span>.finalized) &#123;</span><br><span class="line">            <span class="keyword">return</span></span><br><span class="line">        &#125;</span><br><span class="line">        <span class="keyword">var</span> notString, type = <span class="keyword">typeof</span> message;</span><br><span class="line">        <span class="keyword">if</span> (type !== <span class="string">'string'</span>) &#123;</span><br><span class="line">            <span class="keyword">if</span> (type === <span class="string">'object'</span>) &#123;</span><br><span class="line">                <span class="keyword">if</span> (message === <span class="literal">null</span>) &#123;</span><br><span class="line">                    <span class="keyword">throw</span> <span class="keyword">new</span> <span class="built_in">Error</span>(ERROR)</span><br><span class="line">                &#125; <span class="keyword">else</span> <span class="keyword">if</span> (ARRAY_BUFFER &amp;&amp; message.constructor === <span class="built_in">ArrayBuffer</span>) &#123;</span><br><span class="line">                    message = <span class="keyword">new</span> <span class="built_in">Uint8Array</span>(message)</span><br><span class="line">                &#125; <span class="keyword">else</span> <span class="keyword">if</span> (!<span class="built_in">Array</span>.isArray(message)) &#123;</span><br><span class="line">                    <span class="keyword">if</span> (!ARRAY_BUFFER || !<span class="built_in">ArrayBuffer</span>.isView(message)) &#123;</span><br><span class="line">                        <span class="keyword">throw</span> <span class="keyword">new</span> <span class="built_in">Error</span>(ERROR)</span><br><span class="line">                    &#125;</span><br><span class="line">                &#125;</span><br><span class="line">            &#125; <span class="keyword">else</span> &#123;</span><br><span class="line">                <span class="keyword">throw</span> <span class="keyword">new</span> <span class="built_in">Error</span>(ERROR)</span><br><span class="line">            &#125;</span><br><span class="line">            notString = <span class="literal">true</span></span><br><span class="line">        &#125;</span><br><span class="line">        <span class="keyword">var</span> code, index = <span class="number">0</span>,</span><br><span class="line">            i, length = message.length,</span><br><span class="line">            blocks = <span class="keyword">this</span>.blocks;</span><br><span class="line">        <span class="keyword">while</span> (index &lt; length) &#123;</span><br><span class="line">            <span class="keyword">if</span> (<span class="keyword">this</span>.hashed) &#123;</span><br><span class="line">                <span class="keyword">this</span>.hashed = <span class="literal">false</span>;</span><br><span class="line">                blocks[<span class="number">0</span>] = <span class="keyword">this</span>.block;</span><br><span class="line">                blocks[<span class="number">16</span>] = blocks[<span class="number">1</span>] = blocks[<span class="number">2</span>] = blocks[<span class="number">3</span>] = blocks[<span class="number">4</span>] = blocks[<span class="number">5</span>] = blocks[<span class="number">6</span>] = blocks[<span class="number">7</span>] = blocks[<span class="number">8</span>] = blocks[<span class="number">9</span>] = blocks[<span class="number">10</span>] = blocks[<span class="number">11</span>] = blocks[<span class="number">12</span>] = blocks[<span class="number">13</span>] = blocks[<span class="number">14</span>] = blocks[<span class="number">15</span>] = <span class="number">0</span></span><br><span class="line">            &#125;</span><br><span class="line">            <span class="keyword">if</span> (notString) &#123;</span><br><span class="line">                <span class="keyword">for</span> (i = <span class="keyword">this</span>.start; index &lt; length &amp;&amp; i &lt; <span class="number">64</span>; ++index) &#123;</span><br><span class="line">                    blocks[i &gt;&gt; <span class="number">2</span>] |= message[index] &lt;&lt; SHIFT[i++ &amp; <span class="number">3</span>]</span><br><span class="line">                &#125;</span><br><span class="line">            &#125; <span class="keyword">else</span> &#123;</span><br><span class="line">                <span class="keyword">for</span> (i = <span class="keyword">this</span>.start; index &lt; length &amp;&amp; i &lt; <span class="number">64</span>; ++index) &#123;</span><br><span class="line">                    code = message.charCodeAt(index);</span><br><span class="line">                    <span class="keyword">if</span> (code &lt; <span class="number">0x80</span>) &#123;</span><br><span class="line">                        blocks[i &gt;&gt; <span class="number">2</span>] |= code &lt;&lt; SHIFT[i++ &amp; <span class="number">3</span>]</span><br><span class="line">                    &#125; <span class="keyword">else</span> <span class="keyword">if</span> (code &lt; <span class="number">0x800</span>) &#123;</span><br><span class="line">                        blocks[i &gt;&gt; <span class="number">2</span>] |= (<span class="number">0xc0</span> | (code &gt;&gt; <span class="number">6</span>)) &lt;&lt; SHIFT[i++ &amp; <span class="number">3</span>];</span><br><span class="line">                        blocks[i &gt;&gt; <span class="number">2</span>] |= (<span class="number">0x80</span> | (code &amp; <span class="number">0x3f</span>)) &lt;&lt; SHIFT[i++ &amp; <span class="number">3</span>]</span><br><span class="line">                    &#125; <span class="keyword">else</span> <span class="keyword">if</span> (code &lt; <span class="number">0xd800</span> || code &gt;= <span class="number">0xe000</span>) &#123;</span><br><span class="line">                        blocks[i &gt;&gt; <span class="number">2</span>] |= (<span class="number">0xe0</span> | (code &gt;&gt; <span class="number">12</span>)) &lt;&lt; SHIFT[i++ &amp; <span class="number">3</span>];</span><br><span class="line">                        blocks[i &gt;&gt; <span class="number">2</span>] |= (<span class="number">0x80</span> | ((code &gt;&gt; <span class="number">6</span>) &amp; <span class="number">0x3f</span>)) &lt;&lt; SHIFT[i++ &amp; <span class="number">3</span>];</span><br><span class="line">                        blocks[i &gt;&gt; <span class="number">2</span>] |= (<span class="number">0x80</span> | (code &amp; <span class="number">0x3f</span>)) &lt;&lt; SHIFT[i++ &amp; <span class="number">3</span>]</span><br><span class="line">                    &#125; <span class="keyword">else</span> &#123;</span><br><span class="line">                        code = <span class="number">0x10000</span> + (((code &amp; <span class="number">0x3ff</span>) &lt;&lt; <span class="number">10</span>) | (message.charCodeAt(++index) &amp; <span class="number">0x3ff</span>));</span><br><span class="line">                        blocks[i &gt;&gt; <span class="number">2</span>] |= (<span class="number">0xf0</span> | (code &gt;&gt; <span class="number">18</span>)) &lt;&lt; SHIFT[i++ &amp; <span class="number">3</span>];</span><br><span class="line">                        blocks[i &gt;&gt; <span class="number">2</span>] |= (<span class="number">0x80</span> | ((code &gt;&gt; <span class="number">12</span>) &amp; <span class="number">0x3f</span>)) &lt;&lt; SHIFT[i++ &amp; <span class="number">3</span>];</span><br><span class="line">                        blocks[i &gt;&gt; <span class="number">2</span>] |= (<span class="number">0x80</span> | ((code &gt;&gt; <span class="number">6</span>) &amp; <span class="number">0x3f</span>)) &lt;&lt; SHIFT[i++ &amp; <span class="number">3</span>];</span><br><span class="line">                        blocks[i &gt;&gt; <span class="number">2</span>] |= (<span class="number">0x80</span> | (code &amp; <span class="number">0x3f</span>)) &lt;&lt; SHIFT[i++ &amp; <span class="number">3</span>]</span><br><span class="line">                    &#125;</span><br><span class="line">                &#125;</span><br><span class="line">            &#125;</span><br><span class="line">            <span class="keyword">this</span>.lastByteIndex = i;</span><br><span class="line">            <span class="keyword">this</span>.bytes += i - <span class="keyword">this</span>.start;</span><br><span class="line">            <span class="keyword">if</span> (i &gt;= <span class="number">64</span>) &#123;</span><br><span class="line">                <span class="keyword">this</span>.block = blocks[<span class="number">16</span>];</span><br><span class="line">                <span class="keyword">this</span>.start = i - <span class="number">64</span>;</span><br><span class="line">                <span class="keyword">this</span>.hash();</span><br><span class="line">                <span class="keyword">this</span>.hashed = <span class="literal">true</span></span><br><span class="line">            &#125; <span class="keyword">else</span> &#123;</span><br><span class="line">                <span class="keyword">this</span>.start = i</span><br><span class="line">            &#125;</span><br><span class="line">        &#125;</span><br><span class="line">        <span class="keyword">if</span> (<span class="keyword">this</span>.bytes &gt; <span class="number">4294967295</span>) &#123;</span><br><span class="line">            <span class="keyword">this</span>.hBytes += <span class="keyword">this</span>.bytes / <span class="number">4294967296</span> &lt;&lt; <span class="number">0</span>;</span><br><span class="line">            <span class="keyword">this</span>.bytes = <span class="keyword">this</span>.bytes % <span class="number">4294967296</span></span><br><span class="line">        &#125;</span><br><span class="line">        <span class="keyword">return</span> <span class="keyword">this</span></span><br><span class="line">    &#125;;</span><br><span class="line">    Sha256.prototype.finalize = <span class="function"><span class="keyword">function</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line">        <span class="keyword">if</span> (<span class="keyword">this</span>.finalized) &#123;</span><br><span class="line">            <span class="keyword">return</span></span><br><span class="line">        &#125;</span><br><span class="line">        <span class="keyword">this</span>.finalized = <span class="literal">true</span>;</span><br><span class="line">        <span class="keyword">var</span> blocks = <span class="keyword">this</span>.blocks,</span><br><span class="line">            i = <span class="keyword">this</span>.lastByteIndex;</span><br><span class="line">        blocks[<span class="number">16</span>] = <span class="keyword">this</span>.block;</span><br><span class="line">        blocks[i &gt;&gt; <span class="number">2</span>] |= EXTRA[i &amp; <span class="number">3</span>];</span><br><span class="line">        <span class="keyword">this</span>.block = blocks[<span class="number">16</span>];</span><br><span class="line">        <span class="keyword">if</span> (i &gt;= <span class="number">56</span>) &#123;</span><br><span class="line">            <span class="keyword">if</span> (!<span class="keyword">this</span>.hashed) &#123;</span><br><span class="line">                <span class="keyword">this</span>.hash()</span><br><span class="line">            &#125;</span><br><span class="line">            blocks[<span class="number">0</span>] = <span class="keyword">this</span>.block;</span><br><span class="line">            blocks[<span class="number">16</span>] = blocks[<span class="number">1</span>] = blocks[<span class="number">2</span>] = blocks[<span class="number">3</span>] = blocks[<span class="number">4</span>] = blocks[<span class="number">5</span>] = blocks[<span class="number">6</span>] = blocks[<span class="number">7</span>] = blocks[<span class="number">8</span>] = blocks[<span class="number">9</span>] = blocks[<span class="number">10</span>] = blocks[<span class="number">11</span>] = blocks[<span class="number">12</span>] = blocks[<span class="number">13</span>] = blocks[<span class="number">14</span>] = blocks[<span class="number">15</span>] = <span class="number">0</span></span><br><span class="line">        &#125;</span><br><span class="line">        blocks[<span class="number">14</span>] = <span class="keyword">this</span>.hBytes &lt;&lt; <span class="number">3</span> | <span class="keyword">this</span>.bytes &gt;&gt;&gt; <span class="number">29</span>;</span><br><span class="line">        blocks[<span class="number">15</span>] = <span class="keyword">this</span>.bytes &lt;&lt; <span class="number">3</span>;</span><br><span class="line">        <span class="keyword">this</span>.hash()</span><br><span class="line">    &#125;;</span><br><span class="line">    Sha256.prototype.hash = <span class="function"><span class="keyword">function</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line">        <span class="keyword">var</span> a = <span class="keyword">this</span>.h0,</span><br><span class="line">            b = <span class="keyword">this</span>.h1,</span><br><span class="line">            c = <span class="keyword">this</span>.h2,</span><br><span class="line">            d = <span class="keyword">this</span>.h3,</span><br><span class="line">            e = <span class="keyword">this</span>.h4,</span><br><span class="line">            f = <span class="keyword">this</span>.h5,</span><br><span class="line">            g = <span class="keyword">this</span>.h6,</span><br><span class="line">            h = <span class="keyword">this</span>.h7,</span><br><span class="line">            blocks = <span class="keyword">this</span>.blocks,</span><br><span class="line">            j, s0, s1, maj, t1, t2, ch, ab, da, cd, bc;</span><br><span class="line">        <span class="keyword">for</span> (j = <span class="number">16</span>; j &lt; <span class="number">64</span>; ++j) &#123;</span><br><span class="line">            t1 = blocks[j - <span class="number">15</span>];</span><br><span class="line">            s0 = ((t1 &gt;&gt;&gt; <span class="number">7</span>) | (t1 &lt;&lt; <span class="number">25</span>)) ^ ((t1 &gt;&gt;&gt; <span class="number">18</span>) | (t1 &lt;&lt; <span class="number">14</span>)) ^ (t1 &gt;&gt;&gt; <span class="number">3</span>);</span><br><span class="line">            t1 = blocks[j - <span class="number">2</span>];</span><br><span class="line">            s1 = ((t1 &gt;&gt;&gt; <span class="number">17</span>) | (t1 &lt;&lt; <span class="number">15</span>)) ^ ((t1 &gt;&gt;&gt; <span class="number">19</span>) | (t1 &lt;&lt; <span class="number">13</span>)) ^ (t1 &gt;&gt;&gt; <span class="number">10</span>);</span><br><span class="line">            blocks[j] = blocks[j - <span class="number">16</span>] + s0 + blocks[j - <span class="number">7</span>] + s1 &lt;&lt; <span class="number">0</span></span><br><span class="line">        &#125;</span><br><span class="line">        bc = b &amp; c;</span><br><span class="line">        <span class="keyword">for</span> (j = <span class="number">0</span>; j &lt; <span class="number">64</span>; j += <span class="number">4</span>) &#123;</span><br><span class="line">            <span class="keyword">if</span> (<span class="keyword">this</span>.first) &#123;</span><br><span class="line">                <span class="keyword">if</span> (<span class="keyword">this</span>.is224) &#123;</span><br><span class="line">                    ab = <span class="number">300032</span>;</span><br><span class="line">                    t1 = blocks[<span class="number">0</span>] - <span class="number">1413257819</span>;</span><br><span class="line">                    h = t1 - <span class="number">150054599</span> &lt;&lt; <span class="number">0</span>;</span><br><span class="line">                    d = t1 + <span class="number">24177077</span> &lt;&lt; <span class="number">0</span></span><br><span class="line">                &#125; <span class="keyword">else</span> &#123;</span><br><span class="line">                    ab = <span class="number">704751109</span>;</span><br><span class="line">                    t1 = blocks[<span class="number">0</span>] - <span class="number">210244248</span>;</span><br><span class="line">                    h = t1 - <span class="number">1521486534</span> &lt;&lt; <span class="number">0</span>;</span><br><span class="line">                    d = t1 + <span class="number">143694565</span> &lt;&lt; <span class="number">0</span></span><br><span class="line">                &#125;</span><br><span class="line">                <span class="keyword">this</span>.first = <span class="literal">false</span></span><br><span class="line">            &#125; <span class="keyword">else</span> &#123;</span><br><span class="line">                s0 = ((a &gt;&gt;&gt; <span class="number">2</span>) | (a &lt;&lt; <span class="number">30</span>)) ^ ((a &gt;&gt;&gt; <span class="number">13</span>) | (a &lt;&lt; <span class="number">19</span>)) ^ ((a &gt;&gt;&gt; <span class="number">22</span>) | (a &lt;&lt; <span class="number">10</span>));</span><br><span class="line">                s1 = ((e &gt;&gt;&gt; <span class="number">6</span>) | (e &lt;&lt; <span class="number">26</span>)) ^ ((e &gt;&gt;&gt; <span class="number">11</span>) | (e &lt;&lt; <span class="number">21</span>)) ^ ((e &gt;&gt;&gt; <span class="number">25</span>) | (e &lt;&lt; <span class="number">7</span>));</span><br><span class="line">                ab = a &amp; b;</span><br><span class="line">                maj = ab ^ (a &amp; c) ^ bc;</span><br><span class="line">                ch = (e &amp; f) ^ (~e &amp; g);</span><br><span class="line">                t1 = h + s1 + ch + K[j] + blocks[j];</span><br><span class="line">                t2 = s0 + maj;</span><br><span class="line">                h = d + t1 &lt;&lt; <span class="number">0</span>;</span><br><span class="line">                d = t1 + t2 &lt;&lt; <span class="number">0</span></span><br><span class="line">            &#125;</span><br><span class="line">            s0 = ((d &gt;&gt;&gt; <span class="number">2</span>) | (d &lt;&lt; <span class="number">30</span>)) ^ ((d &gt;&gt;&gt; <span class="number">13</span>) | (d &lt;&lt; <span class="number">19</span>)) ^ ((d &gt;&gt;&gt; <span class="number">22</span>) | (d &lt;&lt; <span class="number">10</span>));</span><br><span class="line">            s1 = ((h &gt;&gt;&gt; <span class="number">6</span>) | (h &lt;&lt; <span class="number">26</span>)) ^ ((h &gt;&gt;&gt; <span class="number">11</span>) | (h &lt;&lt; <span class="number">21</span>)) ^ ((h &gt;&gt;&gt; <span class="number">25</span>) | (h &lt;&lt; <span class="number">7</span>));</span><br><span class="line">            da = d &amp; a;</span><br><span class="line">            maj = da ^ (d &amp; b) ^ ab;</span><br><span class="line">            ch = (h &amp; e) ^ (~h &amp; f);</span><br><span class="line">            t1 = g + s1 + ch + K[j + <span class="number">1</span>] + blocks[j + <span class="number">1</span>];</span><br><span class="line">            t2 = s0 + maj;</span><br><span class="line">            g = c + t1 &lt;&lt; <span class="number">0</span>;</span><br><span class="line">            c = t1 + t2 &lt;&lt; <span class="number">0</span>;</span><br><span class="line">            s0 = ((c &gt;&gt;&gt; <span class="number">2</span>) | (c &lt;&lt; <span class="number">30</span>)) ^ ((c &gt;&gt;&gt; <span class="number">13</span>) | (c &lt;&lt; <span class="number">19</span>)) ^ ((c &gt;&gt;&gt; <span class="number">22</span>) | (c &lt;&lt; <span class="number">10</span>));</span><br><span class="line">            s1 = ((g &gt;&gt;&gt; <span class="number">6</span>) | (g &lt;&lt; <span class="number">26</span>)) ^ ((g &gt;&gt;&gt; <span class="number">11</span>) | (g &lt;&lt; <span class="number">21</span>)) ^ ((g &gt;&gt;&gt; <span class="number">25</span>) | (g &lt;&lt; <span class="number">7</span>));</span><br><span class="line">            cd = c &amp; d;</span><br><span class="line">            maj = cd ^ (c &amp; a) ^ da;</span><br><span class="line">            ch = (g &amp; h) ^ (~g &amp; e);</span><br><span class="line">            t1 = f + s1 + ch + K[j + <span class="number">2</span>] + blocks[j + <span class="number">2</span>];</span><br><span class="line">            t2 = s0 + maj;</span><br><span class="line">            f = b + t1 &lt;&lt; <span class="number">0</span>;</span><br><span class="line">            b = t1 + t2 &lt;&lt; <span class="number">0</span>;</span><br><span class="line">            s0 = ((b &gt;&gt;&gt; <span class="number">2</span>) | (b &lt;&lt; <span class="number">30</span>)) ^ ((b &gt;&gt;&gt; <span class="number">13</span>) | (b &lt;&lt; <span class="number">19</span>)) ^ ((b &gt;&gt;&gt; <span class="number">22</span>) | (b &lt;&lt; <span class="number">10</span>));</span><br><span class="line">            s1 = ((f &gt;&gt;&gt; <span class="number">6</span>) | (f &lt;&lt; <span class="number">26</span>)) ^ ((f &gt;&gt;&gt; <span class="number">11</span>) | (f &lt;&lt; <span class="number">21</span>)) ^ ((f &gt;&gt;&gt; <span class="number">25</span>) | (f &lt;&lt; <span class="number">7</span>));</span><br><span class="line">            bc = b &amp; c;</span><br><span class="line">            maj = bc ^ (b &amp; d) ^ cd;</span><br><span class="line">            ch = (f &amp; g) ^ (~f &amp; h);</span><br><span class="line">            t1 = e + s1 + ch + K[j + <span class="number">3</span>] + blocks[j + <span class="number">3</span>];</span><br><span class="line">            t2 = s0 + maj;</span><br><span class="line">            e = a + t1 &lt;&lt; <span class="number">0</span>;</span><br><span class="line">            a = t1 + t2 &lt;&lt; <span class="number">0</span></span><br><span class="line">        &#125;</span><br><span class="line">        <span class="keyword">this</span>.h0 = <span class="keyword">this</span>.h0 + a &lt;&lt; <span class="number">0</span>;</span><br><span class="line">        <span class="keyword">this</span>.h1 = <span class="keyword">this</span>.h1 + b &lt;&lt; <span class="number">0</span>;</span><br><span class="line">        <span class="keyword">this</span>.h2 = <span class="keyword">this</span>.h2 + c &lt;&lt; <span class="number">0</span>;</span><br><span class="line">        <span class="keyword">this</span>.h3 = <span class="keyword">this</span>.h3 + d &lt;&lt; <span class="number">0</span>;</span><br><span class="line">        <span class="keyword">this</span>.h4 = <span class="keyword">this</span>.h4 + e &lt;&lt; <span class="number">0</span>;</span><br><span class="line">        <span class="keyword">this</span>.h5 = <span class="keyword">this</span>.h5 + f &lt;&lt; <span class="number">0</span>;</span><br><span class="line">        <span class="keyword">this</span>.h6 = <span class="keyword">this</span>.h6 + g &lt;&lt; <span class="number">0</span>;</span><br><span class="line">        <span class="keyword">this</span>.h7 = <span class="keyword">this</span>.h7 + h &lt;&lt; <span class="number">0</span></span><br><span class="line">    &#125;;</span><br><span class="line">    Sha256.prototype.hex = <span class="function"><span class="keyword">function</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line">        <span class="keyword">this</span>.finalize();</span><br><span class="line">        <span class="keyword">var</span> h0 = <span class="keyword">this</span>.h0,</span><br><span class="line">            h1 = <span class="keyword">this</span>.h1,</span><br><span class="line">            h2 = <span class="keyword">this</span>.h2,</span><br><span class="line">            h3 = <span class="keyword">this</span>.h3,</span><br><span class="line">            h4 = <span class="keyword">this</span>.h4,</span><br><span class="line">            h5 = <span class="keyword">this</span>.h5,</span><br><span class="line">            h6 = <span class="keyword">this</span>.h6,</span><br><span class="line">            h7 = <span class="keyword">this</span>.h7;</span><br><span class="line">        <span class="keyword">var</span> hex = HEX_CHARS[(h0 &gt;&gt; <span class="number">28</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h0 &gt;&gt; <span class="number">24</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h0 &gt;&gt; <span class="number">20</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h0 &gt;&gt; <span class="number">16</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h0 &gt;&gt; <span class="number">12</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h0 &gt;&gt; <span class="number">8</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h0 &gt;&gt; <span class="number">4</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[h0 &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h1 &gt;&gt; <span class="number">28</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h1 &gt;&gt; <span class="number">24</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h1 &gt;&gt; <span class="number">20</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h1 &gt;&gt; <span class="number">16</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h1 &gt;&gt; <span class="number">12</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h1 &gt;&gt; <span class="number">8</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h1 &gt;&gt; <span class="number">4</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[h1 &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h2 &gt;&gt; <span class="number">28</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h2 &gt;&gt; <span class="number">24</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h2 &gt;&gt; <span class="number">20</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h2 &gt;&gt; <span class="number">16</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h2 &gt;&gt; <span class="number">12</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h2 &gt;&gt; <span class="number">8</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h2 &gt;&gt; <span class="number">4</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[h2 &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h3 &gt;&gt; <span class="number">28</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h3 &gt;&gt; <span class="number">24</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h3 &gt;&gt; <span class="number">20</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h3 &gt;&gt; <span class="number">16</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h3 &gt;&gt; <span class="number">12</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h3 &gt;&gt; <span class="number">8</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h3 &gt;&gt; <span class="number">4</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[h3 &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h4 &gt;&gt; <span class="number">28</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h4 &gt;&gt; <span class="number">24</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h4 &gt;&gt; <span class="number">20</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h4 &gt;&gt; <span class="number">16</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h4 &gt;&gt; <span class="number">12</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h4 &gt;&gt; <span class="number">8</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h4 &gt;&gt; <span class="number">4</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[h4 &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h5 &gt;&gt; <span class="number">28</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h5 &gt;&gt; <span class="number">24</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h5 &gt;&gt; <span class="number">20</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h5 &gt;&gt; <span class="number">16</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h5 &gt;&gt; <span class="number">12</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h5 &gt;&gt; <span class="number">8</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h5 &gt;&gt; <span class="number">4</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[h5 &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h6 &gt;&gt; <span class="number">28</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h6 &gt;&gt; <span class="number">24</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h6 &gt;&gt; <span class="number">20</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h6 &gt;&gt; <span class="number">16</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h6 &gt;&gt; <span class="number">12</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h6 &gt;&gt; <span class="number">8</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h6 &gt;&gt; <span class="number">4</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[h6 &amp; <span class="number">0x0F</span>];</span><br><span class="line">        <span class="keyword">if</span> (!<span class="keyword">this</span>.is224) &#123;</span><br><span class="line">            hex += HEX_CHARS[(h7 &gt;&gt; <span class="number">28</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h7 &gt;&gt; <span class="number">24</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h7 &gt;&gt; <span class="number">20</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h7 &gt;&gt; <span class="number">16</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h7 &gt;&gt; <span class="number">12</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h7 &gt;&gt; <span class="number">8</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[(h7 &gt;&gt; <span class="number">4</span>) &amp; <span class="number">0x0F</span>] + HEX_CHARS[h7 &amp; <span class="number">0x0F</span>]</span><br><span class="line">        &#125;</span><br><span class="line">        <span class="keyword">return</span> hex</span><br><span class="line">    &#125;;</span><br><span class="line">    Sha256.prototype.toString = Sha256.prototype.hex;</span><br><span class="line">    Sha256.prototype.digest = <span class="function"><span class="keyword">function</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line">        <span class="keyword">this</span>.finalize();</span><br><span class="line">        <span class="keyword">var</span> h0 = <span class="keyword">this</span>.h0,</span><br><span class="line">            h1 = <span class="keyword">this</span>.h1,</span><br><span class="line">            h2 = <span class="keyword">this</span>.h2,</span><br><span class="line">            h3 = <span class="keyword">this</span>.h3,</span><br><span class="line">            h4 = <span class="keyword">this</span>.h4,</span><br><span class="line">            h5 = <span class="keyword">this</span>.h5,</span><br><span class="line">            h6 = <span class="keyword">this</span>.h6,</span><br><span class="line">            h7 = <span class="keyword">this</span>.h7;</span><br><span class="line">        <span class="keyword">var</span> arr = [(h0 &gt;&gt; <span class="number">24</span>) &amp; <span class="number">0xFF</span>, (h0 &gt;&gt; <span class="number">16</span>) &amp; <span class="number">0xFF</span>, (h0 &gt;&gt; <span class="number">8</span>) &amp; <span class="number">0xFF</span>, h0 &amp; <span class="number">0xFF</span>, (h1 &gt;&gt; <span class="number">24</span>) &amp; <span class="number">0xFF</span>, (h1 &gt;&gt; <span class="number">16</span>) &amp; <span class="number">0xFF</span>, (h1 &gt;&gt; <span class="number">8</span>) &amp; <span class="number">0xFF</span>, h1 &amp; <span class="number">0xFF</span>, (h2 &gt;&gt; <span class="number">24</span>) &amp; <span class="number">0xFF</span>, (h2 &gt;&gt; <span class="number">16</span>) &amp; <span class="number">0xFF</span>, (h2 &gt;&gt; <span class="number">8</span>) &amp; <span class="number">0xFF</span>, h2 &amp; <span class="number">0xFF</span>, (h3 &gt;&gt; <span class="number">24</span>) &amp; <span class="number">0xFF</span>, (h3 &gt;&gt; <span class="number">16</span>) &amp; <span class="number">0xFF</span>, (h3 &gt;&gt; <span class="number">8</span>) &amp; <span class="number">0xFF</span>, h3 &amp; <span class="number">0xFF</span>, (h4 &gt;&gt; <span class="number">24</span>) &amp; <span class="number">0xFF</span>, (h4 &gt;&gt; <span class="number">16</span>) &amp; <span class="number">0xFF</span>, (h4 &gt;&gt; <span class="number">8</span>) &amp; <span class="number">0xFF</span>, h4 &amp; <span class="number">0xFF</span>, (h5 &gt;&gt; <span class="number">24</span>) &amp; <span class="number">0xFF</span>, (h5 &gt;&gt; <span class="number">16</span>) &amp; <span class="number">0xFF</span>, (h5 &gt;&gt; <span class="number">8</span>) &amp; <span class="number">0xFF</span>, h5 &amp; <span class="number">0xFF</span>, (h6 &gt;&gt; <span class="number">24</span>) &amp; <span class="number">0xFF</span>, (h6 &gt;&gt; <span class="number">16</span>) &amp; <span class="number">0xFF</span>, (h6 &gt;&gt; <span class="number">8</span>) &amp; <span class="number">0xFF</span>, h6 &amp; <span class="number">0xFF</span>];</span><br><span class="line">        <span class="keyword">if</span> (!<span class="keyword">this</span>.is224) &#123;</span><br><span class="line">            arr.push((h7 &gt;&gt; <span class="number">24</span>) &amp; <span class="number">0xFF</span>, (h7 &gt;&gt; <span class="number">16</span>) &amp; <span class="number">0xFF</span>, (h7 &gt;&gt; <span class="number">8</span>) &amp; <span class="number">0xFF</span>, h7 &amp; <span class="number">0xFF</span>)</span><br><span class="line">        &#125;</span><br><span class="line">        <span class="keyword">return</span> arr</span><br><span class="line">    &#125;;</span><br><span class="line">    Sha256.prototype.array = Sha256.prototype.digest;</span><br><span class="line">    Sha256.prototype.arrayBuffer = <span class="function"><span class="keyword">function</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line">        <span class="keyword">this</span>.finalize();</span><br><span class="line">        <span class="keyword">var</span> buffer = <span class="keyword">new</span> <span class="built_in">ArrayBuffer</span>(<span class="keyword">this</span>.is224 ? <span class="number">28</span> : <span class="number">32</span>);</span><br><span class="line">        <span class="keyword">var</span> dataView = <span class="keyword">new</span> <span class="built_in">DataView</span>(buffer);</span><br><span class="line">        dataView.setUint32(<span class="number">0</span>, <span class="keyword">this</span>.h0);</span><br><span class="line">        dataView.setUint32(<span class="number">4</span>, <span class="keyword">this</span>.h1);</span><br><span class="line">        dataView.setUint32(<span class="number">8</span>, <span class="keyword">this</span>.h2);</span><br><span class="line">        dataView.setUint32(<span class="number">12</span>, <span class="keyword">this</span>.h3);</span><br><span class="line">        dataView.setUint32(<span class="number">16</span>, <span class="keyword">this</span>.h4);</span><br><span class="line">        dataView.setUint32(<span class="number">20</span>, <span class="keyword">this</span>.h5);</span><br><span class="line">        dataView.setUint32(<span class="number">24</span>, <span class="keyword">this</span>.h6);</span><br><span class="line">        <span class="keyword">if</span> (!<span class="keyword">this</span>.is224) &#123;</span><br><span class="line">            dataView.setUint32(<span class="number">28</span>, <span class="keyword">this</span>.h7)</span><br><span class="line">        &#125;</span><br><span class="line">        <span class="keyword">return</span> buffer</span><br><span class="line">    &#125;;</span><br><span class="line"></span><br><span class="line">    <span class="function"><span class="keyword">function</span> <span class="title">HmacSha256</span>(<span class="params">key, is224, sharedMemory</span>) </span>&#123;</span><br><span class="line">        <span class="keyword">var</span> i, type = <span class="keyword">typeof</span> key;</span><br><span class="line">        <span class="keyword">if</span> (type === <span class="string">'string'</span>) &#123;</span><br><span class="line">            <span class="keyword">var</span> bytes = [],</span><br><span class="line">                length = key.length,</span><br><span class="line">                index = <span class="number">0</span>,</span><br><span class="line">                code;</span><br><span class="line">            <span class="keyword">for</span> (i = <span class="number">0</span>; i &lt; length; ++i) &#123;</span><br><span class="line">                code = key.charCodeAt(i);</span><br><span class="line">                <span class="keyword">if</span> (code &lt; <span class="number">0x80</span>) &#123;</span><br><span class="line">                    bytes[index++] = code</span><br><span class="line">                &#125; <span class="keyword">else</span> <span class="keyword">if</span> (code &lt; <span class="number">0x800</span>) &#123;</span><br><span class="line">                    bytes[index++] = (<span class="number">0xc0</span> | (code &gt;&gt; <span class="number">6</span>));</span><br><span class="line">                    bytes[index++] = (<span class="number">0x80</span> | (code &amp; <span class="number">0x3f</span>))</span><br><span class="line">                &#125; <span class="keyword">else</span> <span class="keyword">if</span> (code &lt; <span class="number">0xd800</span> || code &gt;= <span class="number">0xe000</span>) &#123;</span><br><span class="line">                    bytes[index++] = (<span class="number">0xe0</span> | (code &gt;&gt; <span class="number">12</span>));</span><br><span class="line">                    bytes[index++] = (<span class="number">0x80</span> | ((code &gt;&gt; <span class="number">6</span>) &amp; <span class="number">0x3f</span>));</span><br><span class="line">                    bytes[index++] = (<span class="number">0x80</span> | (code &amp; <span class="number">0x3f</span>))</span><br><span class="line">                &#125; <span class="keyword">else</span> &#123;</span><br><span class="line">                    code = <span class="number">0x10000</span> + (((code &amp; <span class="number">0x3ff</span>) &lt;&lt; <span class="number">10</span>) | (key.charCodeAt(++i) &amp; <span class="number">0x3ff</span>));</span><br><span class="line">                    bytes[index++] = (<span class="number">0xf0</span> | (code &gt;&gt; <span class="number">18</span>));</span><br><span class="line">                    bytes[index++] = (<span class="number">0x80</span> | ((code &gt;&gt; <span class="number">12</span>) &amp; <span class="number">0x3f</span>));</span><br><span class="line">                    bytes[index++] = (<span class="number">0x80</span> | ((code &gt;&gt; <span class="number">6</span>) &amp; <span class="number">0x3f</span>));</span><br><span class="line">                    bytes[index++] = (<span class="number">0x80</span> | (code &amp; <span class="number">0x3f</span>))</span><br><span class="line">                &#125;</span><br><span class="line">            &#125;</span><br><span class="line">            key = bytes</span><br><span class="line">        &#125; <span class="keyword">else</span> &#123;</span><br><span class="line">            <span class="keyword">if</span> (type === <span class="string">'object'</span>) &#123;</span><br><span class="line">                <span class="keyword">if</span> (key === <span class="literal">null</span>) &#123;</span><br><span class="line">                    <span class="keyword">throw</span> <span class="keyword">new</span> <span class="built_in">Error</span>(ERROR)</span><br><span class="line">                &#125; <span class="keyword">else</span> <span class="keyword">if</span> (ARRAY_BUFFER &amp;&amp; key.constructor === <span class="built_in">ArrayBuffer</span>) &#123;</span><br><span class="line">                    key = <span class="keyword">new</span> <span class="built_in">Uint8Array</span>(key)</span><br><span class="line">                &#125; <span class="keyword">else</span> <span class="keyword">if</span> (!<span class="built_in">Array</span>.isArray(key)) &#123;</span><br><span class="line">                    <span class="keyword">if</span> (!ARRAY_BUFFER || !<span class="built_in">ArrayBuffer</span>.isView(key)) &#123;</span><br><span class="line">                        <span class="keyword">throw</span> <span class="keyword">new</span> <span class="built_in">Error</span>(ERROR)</span><br><span class="line">                    &#125;</span><br><span class="line">                &#125;</span><br><span class="line">            &#125; <span class="keyword">else</span> &#123;</span><br><span class="line">                <span class="keyword">throw</span> <span class="keyword">new</span> <span class="built_in">Error</span>(ERROR)</span><br><span class="line">            &#125;</span><br><span class="line">        &#125;</span><br><span class="line">        <span class="keyword">if</span> (key.length &gt; <span class="number">64</span>) &#123;</span><br><span class="line">            key = (<span class="keyword">new</span> Sha256(is224, <span class="literal">true</span>)).update(key).array()</span><br><span class="line">        &#125;</span><br><span class="line">        <span class="keyword">var</span> oKeyPad = [],</span><br><span class="line">            iKeyPad = [];</span><br><span class="line">        <span class="keyword">for</span> (i = <span class="number">0</span>; i &lt; <span class="number">64</span>; ++i) &#123;</span><br><span class="line">            <span class="keyword">var</span> b = key[i] || <span class="number">0</span>;</span><br><span class="line">            oKeyPad[i] = <span class="number">0x5c</span> ^ b;</span><br><span class="line">            iKeyPad[i] = <span class="number">0x36</span> ^ b</span><br><span class="line">        &#125;</span><br><span class="line">        Sha256.call(<span class="keyword">this</span>, is224, sharedMemory);</span><br><span class="line">        <span class="keyword">this</span>.update(iKeyPad);</span><br><span class="line">        <span class="keyword">this</span>.oKeyPad = oKeyPad;</span><br><span class="line">        <span class="keyword">this</span>.inner = <span class="literal">true</span>;</span><br><span class="line">        <span class="keyword">this</span>.sharedMemory = sharedMemory</span><br><span class="line">    &#125;</span><br><span class="line">    HmacSha256.prototype = <span class="keyword">new</span> Sha256();</span><br><span class="line">    HmacSha256.prototype.finalize = <span class="function"><span class="keyword">function</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line">        Sha256.prototype.finalize.call(<span class="keyword">this</span>);</span><br><span class="line">        <span class="keyword">if</span> (<span class="keyword">this</span>.inner) &#123;</span><br><span class="line">            <span class="keyword">this</span>.inner = <span class="literal">false</span>;</span><br><span class="line">            <span class="keyword">var</span> innerHash = <span class="keyword">this</span>.array();</span><br><span class="line">            Sha256.call(<span class="keyword">this</span>, <span class="keyword">this</span>.is224, <span class="keyword">this</span>.sharedMemory);</span><br><span class="line">            <span class="keyword">this</span>.update(<span class="keyword">this</span>.oKeyPad);</span><br><span class="line">            <span class="keyword">this</span>.update(innerHash);</span><br><span class="line">            Sha256.prototype.finalize.call(<span class="keyword">this</span>)</span><br><span class="line">        &#125;</span><br><span class="line">    &#125;;</span><br><span class="line">    <span class="keyword">var</span> exports = createMethod();</span><br><span class="line">    exports.sha256 = exports;</span><br><span class="line">    exports.sha224 = createMethod(<span class="literal">true</span>);</span><br><span class="line">    exports.sha256.hmac = createHmacMethod();</span><br><span class="line">    exports.sha224.hmac = createHmacMethod(<span class="literal">true</span>);</span><br><span class="line">    <span class="keyword">if</span> (COMMON_JS) &#123;</span><br><span class="line">        <span class="built_in">module</span>.exports = exports</span><br><span class="line">    &#125; <span class="keyword">else</span> &#123;</span><br><span class="line">        root.sha256 = exports.sha256;</span><br><span class="line">        root.sha224 = exports.sha224;</span><br><span class="line">        <span class="keyword">if</span> (AMD) &#123;</span><br><span class="line">            define(<span class="function"><span class="keyword">function</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line">                <span class="keyword">return</span> exports</span><br><span class="line">            &#125;)</span><br><span class="line">        &#125;</span><br><span class="line">    &#125;</span><br><span class="line">&#125;)();</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">do_something</span>(<span class="params">e</span>) </span>&#123;</span><br><span class="line">    <span class="keyword">for</span> (<span class="keyword">var</span> t = <span class="string">""</span>, n = e.length - <span class="number">1</span>; n &gt;= <span class="number">0</span>; n--) t += e[n];</span><br><span class="line">    <span class="keyword">return</span> t</span><br><span class="line">&#125;</span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">token_part_3</span>(<span class="params">t, y = <span class="string">"ZZ"</span></span>) </span>&#123;</span><br><span class="line">    <span class="built_in">document</span>.getElementById(<span class="string">"token"</span>).value = sha256(<span class="built_in">document</span>.getElementById(<span class="string">"token"</span>).value + y)</span><br><span class="line">&#125;</span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">token_part_2</span>(<span class="params">e = <span class="string">"YY"</span></span>) </span>&#123;</span><br><span class="line">    <span class="built_in">document</span>.getElementById(<span class="string">"token"</span>).value = sha256(e + <span class="built_in">document</span>.getElementById(<span class="string">"token"</span>).value)</span><br><span class="line">&#125;</span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">token_part_1</span>(<span class="params">a, b</span>) </span>&#123;</span><br><span class="line">    <span class="built_in">document</span>.getElementById(<span class="string">"token"</span>).value = do_something(<span class="built_in">document</span>.getElementById(<span class="string">"phrase"</span>).value)</span><br><span class="line">&#125;</span><br><span class="line"><span class="built_in">document</span>.getElementById(<span class="string">"phrase"</span>).value = <span class="string">""</span>;</span><br><span class="line">setTimeout(<span class="function"><span class="keyword">function</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line">    token_part_2(<span class="string">"XX"</span>)</span><br><span class="line">&#125;, <span class="number">300</span>);</span><br><span class="line"><span class="built_in">document</span>.getElementById(<span class="string">"send"</span>).addEventListener(<span class="string">"click"</span>, token_part_3);</span><br><span class="line">token_part_1(<span class="string">"ABCD"</span>, <span class="number">44</span>);</span><br></pre></td></tr></table></figure><p>核心代码主要是后面的几个函数；</p><p>几个函数调用顺序及生成token的步骤如下：</p><ol><li>执行token_part_1()，取phrase值并进行字符串翻转处理；</li><li>延迟300ms后执行token_part_2()，传入参数字符串<code>XX</code>和token值拼接并调用sha256()加密；</li><li>点击按钮时执行token_part_3()，将token值和字符串<code>ZZ</code>拼接并调用sha256()加密，从而得到最终的token；</li></ol><p>先将转换过来的JS前一部分关于sha256算法定义代码输入实现初始化，方便后面直接调用sha256()；</p><p>在输入框输入 success 后，再到控制台中输入<code>token_part_1(&quot;ABCD&quot;, 44)</code>和<code>token_part_2(&quot;XX&quot;)</code>，再点击提交即可完成；</p><p><img src="https://leeyuxun-1258157351.cos.ap-beijing.myqcloud.com/img/20201124000108.png" alt=""></p><p><img src="https://leeyuxun-1258157351.cos.ap-beijing.myqcloud.com/img/20201124001912.png" alt=""></p><p><img src="https://leeyuxun-1258157351.cos.ap-beijing.myqcloud.com/img/20201124000141.png" alt=""></p><h1 id="IMPOSSIBLE"><a href="#IMPOSSIBLE" class="headerlink" title="IMPOSSIBLE"></a>IMPOSSIBLE</h1><h2 id="分析-3"><a href="#分析-3" class="headerlink" title="分析"></a>分析</h2><p>前端直接表明不能相信不安全的输入，没有输入最安全呗；</p><p><img src="https://leeyuxun-1258157351.cos.ap-beijing.myqcloud.com/img/20201124002120.png" alt=""></p></div><div class="my_post_copyright"><script src="//cdn.bootcss.com/clipboard.js/1.5.10/clipboard.min.js"></script><script type="text/javascript" src="http://jslibs.wuxubj.cn/sweetalert_mini/jquery-1.7.1.min.js"></script><script src="http://jslibs.wuxubj.cn/sweetalert_mini/sweetalert.min.js"></script><link rel="stylesheet" type="text/css" href="http://jslibs.wuxubj.cn/sweetalert_mini/sweetalert.mini.css"><link href="css/font-awesome.min.css?v=4.7.0" rel="stylesheet"><script src="//cdn.bootcss.com/clipboard.js/1.5.10/clipboard.min.js"></script><p><span>本文标题: </span><a href="/DVWA-JavaScript-Attacks.html">DVWA JavaScript Attacks</a></p><p><span>文章作者: </span><a href="/" title="访问 李钰璕 的个人博客">李钰璕</a></p><p><span>发布时间: </span>2019年11月23日 - 21:19</p><p><span>最后更新: </span>2020年11月24日 - 00:52</p><p><span>原始链接: </span><a href="/DVWA-JavaScript-Attacks.html" title="DVWA JavaScript Attacks"><a href="https://www.leeyuxun.github.io/DVWA-JavaScript-Attacks.html" title="DVWA JavaScript Attacks">https://www.leeyuxun.github.io/DVWA-JavaScript-Attacks.html</a></a></p><p><span>许可协议: </span>本博客所有文章除特别声明外，均采用<a rel="license" href="https://creativecommons.org/licenses/by-nc-nd/4.0/" target="_blank" title="Attribution-NonCommercial-NoDerivatives 4.0 International (CC BY-NC-ND 4.0)"> <i class="fab fa-creative-commons"></i>BY-NC-SA </a>许可协议，转载请注明出处！</p></div><footer class="post-footer"><div class="post-tags"><a href="/tags/JavaScript-Attacks/" rel="tag"><i class="fa fa-tag"></i> JavaScript Attacks</a></div><div class="post-nav"><div class="post-nav-item"><a href="/DVWA-Insecure-CAPTCHA.html" rel="prev" title="DVWA Insecure CAPTCHA"><i class="fa fa-chevron-left"></i> DVWA Insecure CAPTCHA</a></div><div class="post-nav-item"><a href="/DVWA-Content-Security-Policy-CSP-Bypass.html" rel="next" title="DVWA Content Security Policy (CSP) Bypass">DVWA Content Security Policy (CSP) Bypass <i class="fa fa-chevron-right"></i></a></div></div></footer></article></div><script>window.addEventListener('tabs:register', () => {
    let { activeClass } = CONFIG.comments;
    if (CONFIG.comments.storage) {
      activeClass = localStorage.getItem('comments_active') || activeClass;
    }
    if (activeClass) {
      let activeTab = document.querySelector(`a[href="#comment-${activeClass}"]`);
      if (activeTab) {
        activeTab.click();
      }
    }
  });
  if (CONFIG.comments.storage) {
    window.addEventListener('tabs:click', event => {
      if (!event.target.matches('.tabs-comment .tab-content .tab-pane')) return;
      let commentClass = event.target.classList[1];
      localStorage.setItem('comments_active', commentClass);
    });
  }</script></div><div class="toggle sidebar-toggle"><span class="toggle-line toggle-line-first"></span> <span class="toggle-line toggle-line-middle"></span> <span class="toggle-line toggle-line-last"></span></div><aside class="sidebar"><div class="sidebar-inner"><ul class="sidebar-nav motion-element"><li class="sidebar-nav-toc">文章目录</li><li class="sidebar-nav-overview">站点概览</li></ul><div class="post-toc-wrap sidebar-panel"><div class="post-toc motion-element"><ol class="nav"><li class="nav-item nav-level-1"><a class="nav-link" href="#前言"><span class="nav-number">1.</span> <span class="nav-text">前言</span></a></li><li class="nav-item nav-level-1"><a class="nav-link" href="#LOW"><span class="nav-number">2.</span> <span class="nav-text">LOW</span></a><ol class="nav-child"><li class="nav-item nav-level-2"><a class="nav-link" href="#分析"><span class="nav-number">2.1.</span> <span class="nav-text">分析</span></a></li></ol></li><li class="nav-item nav-level-1"><a class="nav-link" href="#MEDIUM"><span class="nav-number">3.</span> <span class="nav-text">MEDIUM</span></a><ol class="nav-child"><li class="nav-item nav-level-2"><a class="nav-link" href="#分析-1"><span class="nav-number">3.1.</span> <span class="nav-text">分析</span></a></li></ol></li><li class="nav-item nav-level-1"><a class="nav-link" href="#HIGH"><span class="nav-number">4.</span> <span class="nav-text">HIGH</span></a><ol class="nav-child"><li class="nav-item nav-level-2"><a class="nav-link" href="#分析-2"><span class="nav-number">4.1.</span> <span class="nav-text">分析</span></a></li></ol></li><li class="nav-item nav-level-1"><a class="nav-link" href="#IMPOSSIBLE"><span class="nav-number">5.</span> <span class="nav-text">IMPOSSIBLE</span></a><ol class="nav-child"><li class="nav-item nav-level-2"><a class="nav-link" href="#分析-3"><span class="nav-number">5.1.</span> <span class="nav-text">分析</span></a></li></ol></li></ol></div></div><div class="site-overview-wrap sidebar-panel"><div class="site-author motion-element" itemprop="author" itemscope itemtype="http://schema.org/Person"><img class="site-author-image" itemprop="image" alt="李钰璕" src="/images/avatar.png"><p class="site-author-name" itemprop="name">李钰璕</p><div class="site-description" itemprop="description">从0开始学习网络安全</div></div><div class="site-state-wrap motion-element"><nav class="site-state"><div class="site-state-item site-state-posts"><a href="/archives/"><span class="site-state-item-count">64</span> <span class="site-state-item-name">日志</span></a></div><div class="site-state-item site-state-categories"><a href="/categories/"><span class="site-state-item-count">15</span> <span class="site-state-item-name">分类</span></a></div><div class="site-state-item site-state-tags"><a href="/tags/"><span class="site-state-item-count">89</span> <span class="site-state-item-name">标签</span></a></div></nav></div><div class="links-of-author motion-element"><span class="links-of-author-item"><a href="https://github.com/Leeyuxun" title="GitHub → https:&#x2F;&#x2F;github.com&#x2F;Leeyuxun" rel="noopener" target="_blank"><i class="fab fa-github fa-fw"></i></a> </span><span class="links-of-author-item"><a href="mailto:leeyuxun@163.com" title="E-Mail → mailto:leeyuxun@163.com" rel="noopener" target="_blank"><i class="fa fa-envelope fa-fw"></i></a></span></div></div><div class="back-to-top motion-element"><i class="fa fa-arrow-up"></i> <span>0%</span></div></div></aside><div id="sidebar-dimmer"></div></div></main><footer class="footer"><div class="footer-inner"><div class="busuanzi-count"><script async src="https://busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js"></script></div></div></footer></div><script src="/lib/anime.min.js"></script><script src="//cdn.jsdelivr.net/npm/jquery@3/dist/jquery.min.js"></script><script src="//cdn.jsdelivr.net/gh/fancyapps/fancybox@3/dist/jquery.fancybox.min.js"></script><script src="/lib/velocity/velocity.min.js"></script><script src="/lib/velocity/velocity.ui.min.js"></script><script src="/js/utils.js"></script><script src="/js/motion.js"></script><script src="/js/schemes/pisces.js"></script><script src="/js/next-boot.js"></script><script src="/js/local-search.js"></script><script>if (typeof MathJax === 'undefined') {
    window.MathJax = {
      loader: {
          load: ['[tex]/mhchem'],
        source: {
          '[tex]/amsCd': '[tex]/amscd',
          '[tex]/AMScd': '[tex]/amscd'
        }
      },
      tex: {
        inlineMath: {'[+]': [['$', '$']]},
          packages: {'[+]': ['mhchem']},
        tags: 'ams'
      },
      options: {
        renderActions: {
          findScript: [10, doc => {
            document.querySelectorAll('script[type^="math/tex"]').forEach(node => {
              const display = !!node.type.match(/; *mode=display/);
              const math = new doc.options.MathItem(node.textContent, doc.inputJax[0], display);
              const text = document.createTextNode('');
              node.parentNode.replaceChild(text, node);
              math.start = {node: text, delim: '', n: 0};
              math.end = {node: text, delim: '', n: 0};
              doc.math.push(math);
            });
          }, '', false],
          insertedScript: [200, () => {
            document.querySelectorAll('mjx-container').forEach(node => {
              let target = node.parentNode;
              if (target.nodeName.toLowerCase() === 'li') {
                target.parentNode.classList.add('has-jax');
              }
            });
          }, '', false]
        }
      }
    };
    (function () {
      var script = document.createElement('script');
      script.src = '//cdn.jsdelivr.net/npm/mathjax@3/es5/tex-mml-chtml.js';
      script.defer = true;
      document.head.appendChild(script);
    })();
  } else {
    MathJax.startup.document.state(0);
    MathJax.texReset();
    MathJax.typeset();
  }</script></body></html>